Edit tour

Windows Analysis Report
7cduUYXDtl.exe

Overview

General Information

Sample Name:	7cduUYXDtl.exe
Analysis ID:	741320
MD5:	db9b9afc1d0a9e384a46fc36b018e605
SHA1:	c8e97db53c615bbfdb3c6c412a9d84f66cf22c53
SHA256:	fd2fef13a5977859cd31b711618355eaba32082e0863a7e7b2770afff8d7a1fb
Tags:	32exetrojan
Infos:

Detection

Amadey

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Amadeys stealer DLL

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Detected unpacking (overwrites its own PE header)

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Machine Learning detection for sample

Contains functionality to inject code into remote processes

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to steal Instant Messenger accounts or passwords

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Found dropped PE file which has not been started or loaded

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Drops PE files

Contains functionality to read the PEB

Contains functionality to launch a program with higher privileges

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

7cduUYXDtl.exe (PID: 6020 cmdline: C:\Users\user\Desktop\7cduUYXDtl.exe MD5: DB9B9AFC1D0A9E384A46FC36B018E605)

rovwer.exe (PID: 6068 cmdline: "C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe" MD5: DB9B9AFC1D0A9E384A46FC36B018E605)

schtasks.exe (PID: 6112 cmdline: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe" /F MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

rundll32.exe (PID: 5328 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll, Main MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rovwer.exe (PID: 4332 cmdline: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe MD5: DB9B9AFC1D0A9E384A46FC36B018E605)

rovwer.exe (PID: 4304 cmdline: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe MD5: DB9B9AFC1D0A9E384A46FC36B018E605)

rovwer.exe (PID: 4060 cmdline: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe MD5: DB9B9AFC1D0A9E384A46FC36B018E605)

rovwer.exe (PID: 4512 cmdline: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe MD5: DB9B9AFC1D0A9E384A46FC36B018E605)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll	INDICATOR_TOOL_PWS_Amady	Detects password stealer DLL. Dropped by Amadey	ditekSHen	0xd868:$s1: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData 0x15604:$s1: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData 0x16074:$s1: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData 0x15158:$s2: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 0x151bc:$s2: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 0xdd0c:$s3: \Mikrotik\Winbox\Addresses.cdb 0x190d8:$s4: \HostName 0x19100:$s5: \Password 0x17c04:$s6: SOFTWARE\RealVNC\ 0x17c30:$s6: SOFTWARE\RealVNC\ 0x17c5c:$s6: SOFTWARE\RealVNC\ 0x17ca4:$s6: SOFTWARE\RealVNC\ 0x17cd0:$s6: SOFTWARE\RealVNC\ 0x18008:$s7: SOFTWARE\TightVNC\ 0x18034:$s7: SOFTWARE\TightVNC\ 0x18060:$s7: SOFTWARE\TightVNC\ 0x180ac:$s7: SOFTWARE\TightVNC\ 0x1c43c:$s8: cred.dll
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred64[1].dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred64[1].dll	INDICATOR_TOOL_PWS_Amady	Detects password stealer DLL. Dropped by Amadey	ditekSHen	0xd868:$s1: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData 0x15604:$s1: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData 0x16074:$s1: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData 0x15158:$s2: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 0x151bc:$s2: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 0xdd0c:$s3: \Mikrotik\Winbox\Addresses.cdb 0x190d8:$s4: \HostName 0x19100:$s5: \Password 0x17c04:$s6: SOFTWARE\RealVNC\ 0x17c30:$s6: SOFTWARE\RealVNC\ 0x17c5c:$s6: SOFTWARE\RealVNC\ 0x17ca4:$s6: SOFTWARE\RealVNC\ 0x17cd0:$s6: SOFTWARE\RealVNC\ 0x18008:$s7: SOFTWARE\TightVNC\ 0x18034:$s7: SOFTWARE\TightVNC\ 0x18060:$s7: SOFTWARE\TightVNC\ 0x180ac:$s7: SOFTWARE\TightVNC\ 0x1c43c:$s8: cred.dll

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.310346113.00000000021B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000A.00000002.596366750.000000000064F000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10a8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000B.00000002.728180420.000000000072E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1260:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000005.00000002.347151025.000000000087E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1210:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.310156082.00000000005B9000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1168:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000008.00000002.469752989.000000000073E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1168:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000008.00000002.470449059.00000000020D0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000B.00000002.728483158.00000000021C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000A.00000002.596718796.00000000021B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000005.00000002.346989915.0000000000700000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
Click to see the 5 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 7cduUYXDtl.exe	ReversingLabs: Detection: 33%
Source: 7cduUYXDtl.exe	Virustotal: Detection: 30%			Perma Link

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred64[1].dll	Avira: detection malicious, Label: HEUR/AGEN.1233121
Source: C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll	Avira: detection malicious, Label: HEUR/AGEN.1233121

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred64[1].dll	ReversingLabs: Detection: 88%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred64[1].dll	Virustotal: Detection: 84%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred64[1].dll	Metadefender: Detection: 73%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	ReversingLabs: Detection: 33%
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Virustotal: Detection: 30%	Perma Link
Source: C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll	ReversingLabs: Detection: 88%
Source: C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll	Virustotal: Detection: 84%	Perma Link
Source: C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll	Metadefender: Detection: 73%	Perma Link

Machine Learning detection for sample

Source: 7cduUYXDtl.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Unpacked PE file: 0.2.7cduUYXDtl.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Unpacked PE file: 5.2.rovwer.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Unpacked PE file: 8.2.rovwer.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Unpacked PE file: 10.2.rovwer.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Unpacked PE file: 11.2.rovwer.exe.400000.0.unpack

Source: 7cduUYXDtl.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\7cduUYXDtl.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: C:\yewo\carekobe75\tavohagoso74\dayuxot\yufada\kad98\bufexifipodi.pdb source: 7cduUYXDtl.exe, rovwer.exe.0.dr
Source:	Binary string: D:\Mktmp\Amadey\Release\Amadey.pdb source: rovwer.exe, rovwer.exe, 00000005.00000003.345774661.0000000002210000.00000004.00001000.00020000.00000000.sdmp, rovwer.exe, 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, rovwer.exe, 00000008.00000002.469431299.0000000000400000.00000040.00000001.01000000.00000004.sdmp, rovwer.exe, 00000008.00000002.470449059.00000000020D0000.00000040.00001000.00020000.00000000.sdmp, rovwer.exe, 00000008.00000003.468985129.0000000002110000.00000004.00001000.00020000.00000000.sdmp, rovwer.exe, 0000000A.00000003.595086987.00000000021F0000.00000004.00001000.00020000.00000000.sdmp, rovwer.exe, 0000000A.00000002.595671022.0000000000400000.00000040.00000001.01000000.00000004.sdmp, rovwer.exe, 0000000A.00000002.596718796.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, rovwer.exe, 0000000B.00000002.727239286.0000000000400000.00000040.00000001.01000000.00000004.sdmp, rovwer.exe, 0000000B.00000002.728483158.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, rovwer.exe, 0000000B.00000003.725621653.0000000002200000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: JC:\yewo\carekobe75\tavohagoso74\dayuxot\yufada\kad98\bufexifipodi.pdb0>C(/@ source: 7cduUYXDtl.exe, rovwer.exe.0.dr

Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Code function: 0_2_00420BA6 FindFirstFileExW,		0_2_00420BA6
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Code function: 5_2_00420BA6 FindFirstFileExW,		5_2_00420BA6

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 31.41.244.15 80			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.168.2.5 80			Jump to behavior

Source: Joe Sandbox View

ASN Name: AEROEXPRESS-ASRU AEROEXPRESS-ASRU

Source: Joe Sandbox View

IP Address: 31.41.244.15 31.41.244.15

Source: C:\Users\user\Desktop\7cduUYXDtl.exe

Code function: 0_2_00404180 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00404180

Source: C:\Users\user\Desktop\7cduUYXDtl.exe

Code function: 0_2_00402C70 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GdiplusStartup,GetDC,RegGetValueA,RegGetValueA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,RegGetValueA,GetSystemMetrics,GetSystemMetrics,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,SelectObject,DeleteObject,DeleteObject,DeleteObject,ReleaseDC,GdipDisposeImage,GdiplusShutdown,

0_2_00402C70

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.310346113.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000A.00000002.596366750.000000000064F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000B.00000002.728180420.000000000072E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000005.00000002.347151025.000000000087E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.310156082.00000000005B9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000008.00000002.469752989.000000000073E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000008.00000002.470449059.00000000020D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000B.00000002.728483158.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000A.00000002.596718796.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000005.00000002.346989915.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll, type: DROPPED	Matched rule: Detects password stealer DLL. Dropped by Amadey Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred64[1].dll, type: DROPPED	Matched rule: Detects password stealer DLL. Dropped by Amadey Author: ditekSHen

Source: 7cduUYXDtl.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.310346113.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000A.00000002.596366750.000000000064F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000B.00000002.728180420.000000000072E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000005.00000002.347151025.000000000087E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.310156082.00000000005B9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000008.00000002.469752989.000000000073E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000008.00000002.470449059.00000000020D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000B.00000002.728483158.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000A.00000002.596718796.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000005.00000002.346989915.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll, type: DROPPED	Matched rule: INDICATOR_TOOL_PWS_Amady author = ditekSHen, description = Detects password stealer DLL. Dropped by Amadey
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred64[1].dll, type: DROPPED	Matched rule: INDICATOR_TOOL_PWS_Amady author = ditekSHen, description = Detects password stealer DLL. Dropped by Amadey

Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Code function: 0_2_0040CBD0	0_2_0040CBD0
Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Code function: 0_2_00429470	0_2_00429470
Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Code function: 0_2_0042848D	0_2_0042848D
Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Code function: 0_2_00432890	0_2_00432890
Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Code function: 0_2_021D96D7	0_2_021D96D7
Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Code function: 0_2_021D86F4	0_2_021D86F4
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Code function: 5_2_00429470	5_2_00429470
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Code function: 5_2_0042848D	5_2_0042848D
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Code function: 5_2_00432890	5_2_00432890
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Code function: 5_2_0040CBD0	5_2_0040CBD0

Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Code function: String function: 00416F50 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Code function: String function: 00418C40 appears 40 times
Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Code function: String function: 00416F50 appears 130 times
Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Code function: String function: 00418C40 appears 40 times
Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Code function: String function: 021C71B7 appears 53 times

Source: 7cduUYXDtl.exe	Static PE information: Resource name: RT_VERSION type: Intel 80386 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: rovwer.exe.0.dr	Static PE information: Resource name: RT_VERSION type: Intel 80386 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred64[1].dll 351FD9B73FA0CBBDFBCE0793CA41544F5191650D79317A34024F3C09F73AC9BA

Source: 7cduUYXDtl.exe	ReversingLabs: Detection: 33%
Source: 7cduUYXDtl.exe	Virustotal: Detection: 30%

Source: C:\Users\user\Desktop\7cduUYXDtl.exe

File read: C:\Users\user\Desktop\7cduUYXDtl.exe

Jump to behavior

Source: 7cduUYXDtl.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\7cduUYXDtl.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\7cduUYXDtl.exe C:\Users\user\Desktop\7cduUYXDtl.exe
Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Process created: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe "C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe"
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe" /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll, Main
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe
Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Process created: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe "C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe" /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll, Main	Jump to behavior

Source: C:\Users\user\Desktop\7cduUYXDtl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe

File created: C:\Users\user\AppData\Roaming\80b59841e5c623

Jump to behavior

Source: C:\Users\user\Desktop\7cduUYXDtl.exe

File created: C:\Users\user\AppData\Local\Temp\e94c2b28f2

Jump to behavior

Source: classification engine

Classification label: mal100.phis.spyw.evad.winEXE@12/5@0/2

Source: C:\Users\user\Desktop\7cduUYXDtl.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe

Code function: 5_2_0087F23E CreateToolhelp32Snapshot,Module32First,

5_2_0087F23E

Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe

Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll, Main

Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Mutant created: \Sessions\1\BaseNamedObjects\80b59841e5c6230bb2c2395854fd58ec
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6136:120:WilError_01
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\0a3be1459f3ec0fba69ee09d314c27ba

Source: C:\Users\user\Desktop\7cduUYXDtl.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: 7cduUYXDtl.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\yewo\carekobe75\tavohagoso74\dayuxot\yufada\kad98\bufexifipodi.pdb source: 7cduUYXDtl.exe, rovwer.exe.0.dr
Source:	Binary string: D:\Mktmp\Amadey\Release\Amadey.pdb source: rovwer.exe, rovwer.exe, 00000005.00000003.345774661.0000000002210000.00000004.00001000.00020000.00000000.sdmp, rovwer.exe, 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, rovwer.exe, 00000008.00000002.469431299.0000000000400000.00000040.00000001.01000000.00000004.sdmp, rovwer.exe, 00000008.00000002.470449059.00000000020D0000.00000040.00001000.00020000.00000000.sdmp, rovwer.exe, 00000008.00000003.468985129.0000000002110000.00000004.00001000.00020000.00000000.sdmp, rovwer.exe, 0000000A.00000003.595086987.00000000021F0000.00000004.00001000.00020000.00000000.sdmp, rovwer.exe, 0000000A.00000002.595671022.0000000000400000.00000040.00000001.01000000.00000004.sdmp, rovwer.exe, 0000000A.00000002.596718796.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, rovwer.exe, 0000000B.00000002.727239286.0000000000400000.00000040.00000001.01000000.00000004.sdmp, rovwer.exe, 0000000B.00000002.728483158.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, rovwer.exe, 0000000B.00000003.725621653.0000000002200000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: JC:\yewo\carekobe75\tavohagoso74\dayuxot\yufada\kad98\bufexifipodi.pdb0>C(/@ source: 7cduUYXDtl.exe, rovwer.exe.0.dr

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Unpacked PE file: 0.2.7cduUYXDtl.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Unpacked PE file: 5.2.rovwer.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Unpacked PE file: 8.2.rovwer.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Unpacked PE file: 10.2.rovwer.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Unpacked PE file: 11.2.rovwer.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Unpacked PE file: 0.2.7cduUYXDtl.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Unpacked PE file: 5.2.rovwer.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Unpacked PE file: 8.2.rovwer.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Unpacked PE file: 10.2.rovwer.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Unpacked PE file: 11.2.rovwer.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Code function: 0_2_00418C86 push ecx; ret	0_2_00418C99
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Code function: 5_2_00418C86 push ecx; ret	5_2_00418C99
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Code function: 5_2_008842D0 push 54850227h; ret	5_2_00884329
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Code function: 5_2_0087E4B2 push edi; iretd	5_2_0087E4B3
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Code function: 5_2_00882403 push cs; ret	5_2_0088241F

Source: C:\Users\user\Desktop\7cduUYXDtl.exe	File created: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	File created: C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll	Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup

Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe" /F

Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe TID: 6072	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe TID: 6128	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe TID: 6124	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe TID: 6132	Thread sleep time: -1800000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe TID: 6072	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred64[1].dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Thread delayed: delay time: 180000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Thread delayed: delay time: 360000			Jump to behavior

Source: C:\Users\user\Desktop\7cduUYXDtl.exe	API coverage: 4.4 %
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	API coverage: 4.7 %

Source: C:\Users\user\Desktop\7cduUYXDtl.exe

Code function: 0_2_00405400 GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo,

0_2_00405400

Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Code function: 0_2_00420BA6 FindFirstFileExW,		0_2_00420BA6
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Code function: 5_2_00420BA6 FindFirstFileExW,		5_2_00420BA6

Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Thread delayed: delay time: 50000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Thread delayed: delay time: 360000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: C:\Users\user\Desktop\7cduUYXDtl.exe

Code function: 0_2_00418A67 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00418A67

Source: C:\Users\user\Desktop\7cduUYXDtl.exe

Code function: 0_2_004037D0 DeleteObject,GetUserNameW,GetUserNameW,GetProcessHeap,GetProcessHeap,HeapAlloc,GetUserNameW,LookupAccountNameW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,LookupAccountNameW,ConvertSidToStringSidW,LocalAlloc,GetProcessHeap,HeapFree,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,LocalFree,

0_2_004037D0

Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Code function: 0_2_0041B901 mov eax, dword ptr fs:[00000030h]	0_2_0041B901
Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Code function: 0_2_0041DF02 mov eax, dword ptr fs:[00000030h]	0_2_0041DF02
Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Code function: 0_2_021B092B mov eax, dword ptr fs:[00000030h]	0_2_021B092B
Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Code function: 0_2_021CE169 mov eax, dword ptr fs:[00000030h]	0_2_021CE169
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Code function: 5_2_0041B901 mov eax, dword ptr fs:[00000030h]	5_2_0041B901
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Code function: 5_2_0041DF02 mov eax, dword ptr fs:[00000030h]	5_2_0041DF02
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Code function: 5_2_0087EB1B push dword ptr fs:[00000030h]	5_2_0087EB1B

Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Code function: 0_2_00418163 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00418163
Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Code function: 0_2_00418A67 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00418A67
Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Code function: 0_2_0041CA80 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041CA80
Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Code function: 0_2_00418BCC SetUnhandledExceptionFilter,	0_2_00418BCC
Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Code function: 0_2_021C83CA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_021C83CA
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Code function: 5_2_00418163 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00418163
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Code function: 5_2_00418A67 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00418A67
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Code function: 5_2_0041CA80 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_0041CA80
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Code function: 5_2_00418BCC SetUnhandledExceptionFilter,	5_2_00418BCC

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 31.41.244.15 80			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.168.2.5 80			Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\7cduUYXDtl.exe

Code function: 0_2_00403F40 GetModuleFileNameA,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,VirtualFree,

0_2_00403F40

Source: C:\Users\user\Desktop\7cduUYXDtl.exe

Code function: 0_2_00404350 ShellExecuteA,

0_2_00404350

Source: C:\Users\user\Desktop\7cduUYXDtl.exe	Process created: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe "C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe" /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll, Main	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Queries volume information: C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Queries volume information: C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\853321935212 VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\7cduUYXDtl.exe

Code function: 0_2_00418887 cpuid

0_2_00418887

Source: C:\Users\user\Desktop\7cduUYXDtl.exe

Code function: 0_2_00418CA1 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00418CA1

Source: C:\Users\user\Desktop\7cduUYXDtl.exe

Code function: 0_2_00424BC4 _free,_free,_free,GetTimeZoneInformation,_free,

0_2_00424BC4

Source: C:\Users\user\Desktop\7cduUYXDtl.exe

Code function: 0_2_00405400 GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo,

0_2_00405400

Source: C:\Users\user\Desktop\7cduUYXDtl.exe

Code function: 0_2_0040CBD0 GetUserNameA,SetCurrentDirectoryA,GetFileAttributesA,RtlAllocateHeap,CreateDirectoryA,GetFileAttributesA,GetModuleFileNameA,SetCurrentDirectoryA,std::_Xinvalid_argument,std::_Xinvalid_argument,std::_Xinvalid_argument,

0_2_0040CBD0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred64[1].dll, type: DROPPED

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\rundll32.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\SysWOW64\rundll32.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\SysWOW64\rundll32.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\sitemanager.xml

Jump to behavior

Tries to steal Instant Messenger accounts or passwords

Source: C:\Windows\SysWOW64\rundll32.exe

File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	211 Process Injection	2 Obfuscated Files or Information	2 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 Scheduled Task/Job	2 Software Packing	1 Credentials In Files	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	1 Registry Run Keys / Startup Folder	1 Masquerading	NTDS	24 System Information Discovery	Distributed Component Object Model	1 Email Collection	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	21 Virtualization/Sandbox Evasion	LSA Secrets	12 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	211 Process Injection	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Rundll32	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Owner/User Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
7cduUYXDtl.exe	33%	ReversingLabs	Win32.Downloader.Deyma
7cduUYXDtl.exe	31%	Virustotal		Browse
7cduUYXDtl.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred64[1].dll	100%	Avira	HEUR/AGEN.1233121
C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll	100%	Avira	HEUR/AGEN.1233121
C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred64[1].dll	88%	ReversingLabs	Win32.Infostealer.Decred
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred64[1].dll	85%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred64[1].dll	73%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	33%	ReversingLabs	Win32.Downloader.Deyma
C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe	31%	Virustotal		Browse
C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll	88%	ReversingLabs	Win32.Infostealer.Decred
C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll	85%	Virustotal		Browse
C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll	73%	Metadefender		Browse

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
31.41.244.15	unknown	Russian Federation		61974	AEROEXPRESS-ASRU	true

Private

IP
192.168.2.5

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	741320
Start date and time:	2022-11-08 22:08:50 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	7cduUYXDtl.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.phis.spyw.evad.winEXE@12/5@0/2
EGA Information:	Successful, ratio: 66.7%
HDC Information:	Failed
HCA Information:	Successful, ratio: 95% Number of executed functions: 26 Number of non-executed functions: 109
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for rundll32

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:09:53	API Interceptor	2569x Sleep call for process: rovwer.exe modified
22:09:56	Task Scheduler	Run new task: rovwer.exe path: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
31.41.244.15	7ZSVh1b31u.dll	Get hash	malicious	Browse	31.41.244.15/Mb1sDv3/index.php
31.41.244.15	7ZSVh1b31u.dll	Get hash	malicious	Browse	31.41.244.15/Mb1sDv3/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AEROEXPRESS-ASRU	5SeusTm9PP.exe	Get hash	malicious	Browse	31.41.244.60
	Hz47QoWpbQ.exe	Get hash	malicious	Browse	31.41.244.15
	file.exe	Get hash	malicious	Browse	31.41.244.15
	e0dObe3eM5.exe	Get hash	malicious	Browse	31.41.244.15
	Yz6YgTF176.exe	Get hash	malicious	Browse	31.41.244.15
	E4DwsGOz55.exe	Get hash	malicious	Browse	31.41.244.15
	eveTY9PQSn.exe	Get hash	malicious	Browse	31.41.244.15
	file.exe	Get hash	malicious	Browse	31.41.244.15
	tNID7H5KEX.exe	Get hash	malicious	Browse	31.41.244.152
	vmBqMjIDpo.exe	Get hash	malicious	Browse	31.41.244.15
	file.exe	Get hash	malicious	Browse	31.41.244.15
	file.exe	Get hash	malicious	Browse	31.41.244.15
	UN2Rniz3fX.exe	Get hash	malicious	Browse	31.41.244.15
	file.exe	Get hash	malicious	Browse	31.41.244.15
	Aqv8EIlBSv.exe	Get hash	malicious	Browse	31.41.244.15
	SecuriteInfo.com.Win32.Evo-gen.5319.28457.exe	Get hash	malicious	Browse	31.41.244.15
	Rk3ESqz3hB.exe	Get hash	malicious	Browse	31.41.244.15
	PC5YUEww4R.exe	Get hash	malicious	Browse	31.41.244.15
	10Mmtni5Ix.exe	Get hash	malicious	Browse	31.41.244.15
	5O7C2l2wpv.exe	Get hash	malicious	Browse	31.41.244.15

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred64[1].dll	Hz47QoWpbQ.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	FU6NClCGZ6.exe	Get hash	malicious	Browse
	36a0e4825153e93f6d7f87a37aac9cbf9f1a5cac5c832.exe	Get hash	malicious	Browse
	e0dObe3eM5.exe	Get hash	malicious	Browse
	Yz6YgTF176.exe	Get hash	malicious	Browse
	E4DwsGOz55.exe	Get hash	malicious	Browse
	eveTY9PQSn.exe	Get hash	malicious	Browse
	5V8AcHizAb.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	0IuMP4sNBR.exe	Get hash	malicious	Browse
	vmBqMjIDpo.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	BFj8w9pt0x.exe	Get hash	malicious	Browse
	PThVjP3LMr.exe	Get hash	malicious	Browse
	UN2Rniz3fX.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred64[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	129024
Entropy (8bit):	6.511772093814294
Encrypted:	false
SSDEEP:	3072:ox7pOYzBekEmWDWCMq6As523HeS9FAiZ87vO2rlL3Rnu9:ox7ZNhE/dMq6AO0a7vVlT
MD5:	522ADAD0782501491314A78C7F32006B
SHA1:	E487EDCEEEF3A41E2A8EEA1E684BCBC3B39ADB97
SHA-256:	351FD9B73FA0CBBDFBCE0793CA41544F5191650D79317A34024F3C09F73AC9BA
SHA-512:	5F8A103DEEA3ED5F8641D1F4C91A4F891A8208B679CADBFAC4A068AFBAD0D2F777CD29ACE4BDFEC590E722435473E4F8465FB80D5CDA792DC0236646580101A7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred64[1].dll, Author: Joe Security Rule: INDICATOR_TOOL_PWS_Amady, Description: Detects password stealer DLL. Dropped by Amadey, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred64[1].dll, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 85%, Browse Antivirus: Metadefender, Detection: 73%, Browse
Joe Sandbox View:	Filename: Hz47QoWpbQ.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: FU6NClCGZ6.exe, Detection: malicious, Browse Filename: 36a0e4825153e93f6d7f87a37aac9cbf9f1a5cac5c832.exe, Detection: malicious, Browse Filename: e0dObe3eM5.exe, Detection: malicious, Browse Filename: Yz6YgTF176.exe, Detection: malicious, Browse Filename: E4DwsGOz55.exe, Detection: malicious, Browse Filename: eveTY9PQSn.exe, Detection: malicious, Browse Filename: 5V8AcHizAb.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 0IuMP4sNBR.exe, Detection: malicious, Browse Filename: vmBqMjIDpo.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: BFj8w9pt0x.exe, Detection: malicious, Browse Filename: PThVjP3LMr.exe, Detection: malicious, Browse Filename: UN2Rniz3fX.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................X......x.............@..........................@..........................................O.......&.... ..............................................................................................................CODE................................ ..`DATA................................@...BSS......................................idata..&...........................@....edata..O...........................@..P.reloc..............................@..P.rsrc........ ......................@..P.............@......................@..P................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\853321935212

Download File

Process:	C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	84204
Entropy (8bit):	7.897952942528722
Encrypted:	false
SSDEEP:	1536:CM5PR/yveXYRZ3BPhuZz+dnTh30h6Qe01tBbdMn9ODwC1rF6FQz:V/ueoRy+dnV0fbtbkL+rH
MD5:	5867ABCBA7E32B56C46EED9CBDD7BD7C
SHA1:	E9B3727E93F41DA41A611A1555975123DBDDD24A
SHA-256:	0950A3A7AF3DE357AA21D31F3DA43B585CC7DE6CBDA109EB41F7A5C1D40CBA5A
SHA-512:	D90D891316EDE8BCED4EEE9796FB92F9226A3AC4AD76D1C2E827BC21DEC885686860D6156FA59A84A4E0C8071CDB6596A72523CBB59E69A825AF30DF3F537A0E
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..01KK...lq\....xcS.m..#Hm.....T......<!...wq5...v1.?S.....rHj-.U:...5............\|..+.......}...<.>...H.......Wo.CK`/l.1./...C...W.....,1....R.0.W.A.:.....X.l..1lN23....._....m.....'.........S.. ..W....'.c....1....5.5.}j.Ly..k;.\...q.U..Q...bgJpW.(QKI]&b.QE.&(..Y.)....\..._.\|.'..wy.....h..S'.8.gc.k...S~.............?.M....?.7?...Y.x.{&\|.E{....B.......~..

C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe

Download File

Process:	C:\Users\user\Desktop\7cduUYXDtl.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	227840
Entropy (8bit):	7.314337555799433
Encrypted:	false
SSDEEP:	6144:qLzJx2ryTayck4ZWB80CFowVshPZmiCgL:q3Jx2ryeycn0B119hPZm
MD5:	DB9B9AFC1D0A9E384A46FC36B018E605
SHA1:	C8E97DB53C615BBFDB3C6C412A9D84F66CF22C53
SHA-256:	FD2FEF13A5977859CD31B711618355EABA32082E0863A7E7B2770AFFF8D7A1FB
SHA-512:	767D1ABE7E86FDCCFE673559AAB2FF17065DB4C3416420FF86205F87F8D67FFC66121537306517F21566DBD65B125E6C707DBA3D75206E1834D27071FB905BC7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 33% Antivirus: Virustotal, Detection: 31%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........4.4.U.g.U.g.U.g..xg.U.g..ng.U.g...g.U.g.U.gLU.g..ig.U.g..yg.U.g..\|g.U.gRich.U.g................PE..L....n.`.................8...........d.......P....@..........................0..............................................,:..P........;..........................p...............................P...@............................................text...T6.......8.................. ..`.data........P.......<..............@....rsrc....;.......<...>..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\7cduUYXDtl.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	129024
Entropy (8bit):	6.511772093814294
Encrypted:	false
SSDEEP:	3072:ox7pOYzBekEmWDWCMq6As523HeS9FAiZ87vO2rlL3Rnu9:ox7ZNhE/dMq6AO0a7vVlT
MD5:	522ADAD0782501491314A78C7F32006B
SHA1:	E487EDCEEEF3A41E2A8EEA1E684BCBC3B39ADB97
SHA-256:	351FD9B73FA0CBBDFBCE0793CA41544F5191650D79317A34024F3C09F73AC9BA
SHA-512:	5F8A103DEEA3ED5F8641D1F4C91A4F891A8208B679CADBFAC4A068AFBAD0D2F777CD29ACE4BDFEC590E722435473E4F8465FB80D5CDA792DC0236646580101A7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll, Author: Joe Security Rule: INDICATOR_TOOL_PWS_Amady, Description: Detects password stealer DLL. Dropped by Amadey, Source: C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 85%, Browse Antivirus: Metadefender, Detection: 73%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................X......x.............@..........................@..........................................O.......&.... ..............................................................................................................CODE................................ ..`DATA................................@...BSS......................................idata..&...........................@....edata..O...........................@..P.reloc..............................@..P.rsrc........ ......................@..P.............@......................@..P................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.314337555799433
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	7cduUYXDtl.exe
File size:	227840
MD5:	db9b9afc1d0a9e384a46fc36b018e605
SHA1:	c8e97db53c615bbfdb3c6c412a9d84f66cf22c53
SHA256:	fd2fef13a5977859cd31b711618355eaba32082e0863a7e7b2770afff8d7a1fb
SHA512:	767d1abe7e86fdccfe673559aab2ff17065db4c3416420ff86205f87f8d67ffc66121537306517f21566dbd65b125e6c707dba3d75206e1834d27071fb905bc7
SSDEEP:	6144:qLzJx2ryTayck4ZWB80CFowVshPZmiCgL:q3Jx2ryeycn0B119hPZm
TLSH:	DA24F1227A90C433C3631A705869C3E5A77EBA7159F99A8777580B3D5F302D26A37307
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........4.4.U.g.U.g.U.g..xg.U.g..ng.U.g...g.U.g.U.gLU.g..ig.U.g..yg.U.g..\|g.U.gRich.U.g................PE..L....n.`.................8.

File Icon


Icon Hash:	c8d0d8e0f0e0e4e8

Static PE Info

General

Entrypoint:	0x406406
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x60F16EC9 [Fri Jul 16 11:34:33 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	3587bc86d8ee27a5cdc406b441581e5c

Entrypoint Preview

Instruction
call 00007F37F8C7B6FCh
jmp 00007F37F8C7508Eh
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007F37F8C75236h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007F37F8C75260h
test ecx, 00000003h
jne 00007F37F8C75201h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007F37F8C751FAh
mov eax, dword ptr [ecx-04h]
test al, al
je 00007F37F8C75244h
test ah, ah
je 00007F37F8C75236h
test eax, 00FF0000h
je 00007F37F8C75225h
test eax, FF000000h
je 00007F37F8C75214h
jmp 00007F37F8C751DFh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+14h]
push esi
push edi
xor edi, edi
cmp eax, edi
je 00007F37F8C75259h
cmp dword ptr [ebp+08h], edi
jne 00007F37F8C7522Dh
call 00007F37F8C75E14h
push 00000016h
pop esi
mov dword ptr [eax], esi
push edi
push edi
push edi
push edi
push edi
call 00007F37F8C75D9Dh
add esp, 14h
mov eax, esi
jmp 00007F37F8C7523Bh
cmp dword ptr [ebp+10h], edi

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13a2c	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18f000	0x3b80	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1270	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2e50	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x214	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x13654	0x13800	False	0.5090269431089743	data	6.1006359701402815	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x15000	0x17939c	0x20200	False	0.9441953428988327	data	7.847490882724738	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x18f000	0x3b80	0x3c00	False	0.6152994791666667	data	5.552803096579343	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AFX_DIALOG_LAYOUT	0x1920d0	0x2	data
AFX_DIALOG_LAYOUT	0x1920c8	0x2	data
AFX_DIALOG_LAYOUT	0x1920d8	0x2	data
AFX_DIALOG_LAYOUT	0x1920e0	0x2	data
AFX_DIALOG_LAYOUT	0x1920e8	0x2	data
RT_ICON	0x18f500	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania
RT_ICON	0x18fbc8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania
RT_ICON	0x190130	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania
RT_ICON	0x1911d8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania
RT_ICON	0x191b60	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania
RT_STRING	0x192240	0x334	data	Romanian	Romania
RT_STRING	0x192578	0x210	data	Romanian	Romania
RT_STRING	0x192788	0x244	data	Romanian	Romania
RT_STRING	0x1929d0	0x1ae	data	Romanian	Romania
RT_ACCELERATOR	0x192018	0x60	data	Romanian	Romania
RT_GROUP_ICON	0x191fc8	0x4c	data	Romanian	Romania
RT_VERSION	0x1920f0	0x14c	Intel 80386 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
None	0x192088	0xa	data	Romanian	Romania
None	0x192098	0xa	data	Romanian	Romania
None	0x192078	0xa	data	Romanian	Romania
None	0x1920a8	0xa	data	Romanian	Romania
None	0x1920b8	0xa	data	Romanian	Romania

Imports

DLL	Import
KERNEL32.dll	LoadLibraryW, GetVolumeInformationA, SetComputerNameA, LocalFlags, InterlockedDecrement, GetTickCount, SearchPathA, GetConsoleAliasExesLengthW, EnumSystemCodePagesW, LocalFree, FindNextFileW, TlsSetValue, CopyFileExW, MoveFileWithProgressW, SetVolumeLabelW, GetProfileSectionA, VerifyVersionInfoA, QueryDosDeviceW, LocalReAlloc, DosDateTimeToFileTime, VirtualQuery, WaitForDebugEvent, GlobalGetAtomNameW, MapViewOfFile, GetWindowsDirectoryA, GetModuleHandleW, VirtualProtect, FindNextVolumeMountPointW, IsBadWritePtr, DeleteAtom, LoadResource, WriteConsoleInputW, CopyFileA, CancelWaitableTimer, LocalAlloc, FindResourceW, OpenEventA, GetThreadPriority, CallNamedPipeA, GetProcAddress, GetModuleHandleA, GetConsoleAliasesLengthW, OpenFileMappingW, GetSystemWindowsDirectoryA, GetOEMCP, GetMailslotInfo, GetConsoleAliasA, GetFileInformationByHandle, GetDiskFreeSpaceExA, DefineDosDeviceA, GetCPInfo, GetProcessAffinityMask, GlobalFindAtomA, WriteConsoleA, ReleaseActCtx, FindNextVolumeW, LoadLibraryA, LeaveCriticalSection, GetComputerNameW, MoveFileA, InitializeCriticalSection, GetPrivateProfileStructA, InterlockedCompareExchange, InterlockedIncrement, EnumCalendarInfoA, InterlockedExchange, GetNamedPipeHandleStateA, SetFileApisToANSI, SetFileTime, CreateFileA, CloseHandle, Sleep, DeleteCriticalSection, EnterCriticalSection, RaiseException, RtlUnwind, GetLastError, HeapReAlloc, HeapAlloc, HeapFree, UnhandledExceptionFilter, SetUnhandledExceptionFilter, DeleteFileA, GetStartupInfoW, TerminateProcess, GetCurrentProcess, IsDebuggerPresent, TlsGetValue, TlsAlloc, TlsFree, SetLastError, GetCurrentThreadId, HeapCreate, VirtualFree, VirtualAlloc, HeapSize, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, SetHandleCount, GetFileType, GetStartupInfoA, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetACP, IsValidCodePage, GetLocaleInfoA, GetStringTypeA, MultiByteToWideChar, GetStringTypeW, InitializeCriticalSectionAndSpinCount, SetFilePointer, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, LCMapStringA, LCMapStringW, FlushFileBuffers, SetStdHandle, GetConsoleOutputCP, WriteConsoleW, ReadFile
USER32.dll	GetAltTabInfoW
WINHTTP.dll	WinHttpWriteData

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Target ID:	0
Start time:	22:09:48
Start date:	08/11/2022
Path:	C:\Users\user\Desktop\7cduUYXDtl.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\7cduUYXDtl.exe
Imagebase:	0x400000
File size:	227840 bytes
MD5 hash:	DB9B9AFC1D0A9E384A46FC36B018E605
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.310346113.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.310156082.00000000005B9000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	22:09:51
Start date:	08/11/2022
Path:	C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe"
Imagebase:	0x400000
File size:	227840 bytes
MD5 hash:	DB9B9AFC1D0A9E384A46FC36B018E605
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 33%, ReversingLabs Detection: 31%, Virustotal, Browse
Reputation:	low

Show Windows behavior

Target ID:	2
Start time:	22:09:53
Start date:	08/11/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe" /F
Imagebase:	0x390000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	3
Start time:	22:09:54
Start date:	08/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	4
Start time:	22:09:55
Start date:	08/11/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll, Main
Imagebase:	0x2c0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high

Show Windows behavior

Target ID:	5
Start time:	22:09:56
Start date:	08/11/2022
Path:	C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe
Imagebase:	0x400000
File size:	227840 bytes
MD5 hash:	DB9B9AFC1D0A9E384A46FC36B018E605
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.347151025.000000000087E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000005.00000002.346989915.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Target ID:	8
Start time:	22:11:00
Start date:	08/11/2022
Path:	C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe
Imagebase:	0x400000
File size:	227840 bytes
MD5 hash:	DB9B9AFC1D0A9E384A46FC36B018E605
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000008.00000002.469752989.000000000073E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000008.00000002.470449059.00000000020D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Target ID:	10
Start time:	22:12:00
Start date:	08/11/2022
Path:	C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe
Imagebase:	0x400000
File size:	227840 bytes
MD5 hash:	DB9B9AFC1D0A9E384A46FC36B018E605
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000A.00000002.596366750.000000000064F000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000A.00000002.596718796.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Target ID:	11
Start time:	22:13:00
Start date:	08/11/2022
Path:	C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe
Imagebase:	0x400000
File size:	227840 bytes
MD5 hash:	DB9B9AFC1D0A9E384A46FC36B018E605
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000B.00000002.728180420.000000000072E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000B.00000002.728483158.00000000021C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	5.2%
Signature Coverage:	4.2%
Total number of Nodes:	308
Total number of Limit Nodes:	10

Executed Functions

Function 0040CBD0 Relevance: 30.0, APIs: 10, Strings: 5, Instructions: 3727COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040CD3E
SetCurrentDirectoryA.KERNEL32(00000000,?,?), ref: 0040CD9C

Part of subcall function 00416A90: Concurrency::cancel_current_task.LIBCPMT ref: 00416B49

Part of subcall function 00402C70: RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,3A108541,3A108541), ref: 00402E1C
Part of subcall function 00402C70: RegQueryValueExA.ADVAPI32(3A108541,?,00000000,00000000,?,00000400,?,?,00000000,00000001,3A108541,3A108541), ref: 00402E4A
Part of subcall function 00402C70: RegCloseKey.ADVAPI32(3A108541,?,?,00000000,00000001,3A108541,3A108541), ref: 00402E56

Part of subcall function 00402C70: RegOpenKeyExA.ADVAPI32(80000001,80000001,00000000,000F003F,00000001), ref: 00402F63
Part of subcall function 00402C70: RegSetValueExA.ADVAPI32(80000001,?,00000000,00000002,?,?), ref: 00402F91
Part of subcall function 00402C70: RegCloseKey.ADVAPI32(80000001), ref: 00402F9A

Part of subcall function 004048C0: Sleep.KERNEL32(000003E8), ref: 004049A9

GetFileAttributesA.KERNEL32(00000000), ref: 0040E4F1
CreateDirectoryA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040E623
GetFileAttributesA.KERNEL32(00000000), ref: 0040E738
GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000), ref: 0040ED75
std::_Xinvalid_argument.LIBCPMT ref: 0040F9E5

Part of subcall function 00402C70: GdiplusStartup.GDIPLUS(?,?,00000000,3A108541), ref: 004030CA

Part of subcall function 0040CBD0: SetCurrentDirectoryA.KERNEL32(00000000), ref: 0040EF9C

Strings

%, xrefs: 00410047
", xrefs: 0040FE0B
", xrefs: 0040EEF2
stoi argument out of range, xrefs: 0040F9F4, 0041032D
invalid stoi argument, xrefs: 0040F9E0, 00410314, 00410323

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: DirectoryFile$AttributesCloseCurrentNameOpenValue$Concurrency::cancel_current_taskCreateGdiplusModuleQuerySleepStartupUserXinvalid_argumentstd::_
String ID: "$"$%$invalid stoi argument$stoi argument out of range
API String ID: 1674928435-2043294232
Opcode ID: 15be58a0eef31b6c65ba771fdf33b6d5f965c5bcbdd72336a2d9a83a28370cc5
Instruction ID: ca7d88425734236cf169f520bb3e28de2df1445630f25be11c52c40f1bbbcbb8
Opcode Fuzzy Hash: 15be58a0eef31b6c65ba771fdf33b6d5f965c5bcbdd72336a2d9a83a28370cc5
Instruction Fuzzy Hash: 07632A71A001489BEB18DB38CD897DD7B729F86304F5082ADE409A73D6DB3D9EC48B59

Uniqueness

Uniqueness Score: -1.00%

Function 0041B901 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,0041B900,0041BE86,?,NA,0041BE86,0041EF4E), ref: 0041B923
TerminateProcess.KERNEL32(00000000,?,0041B900,0041BE86,?,NA,0041BE86,0041EF4E), ref: 0041B92A
ExitProcess.KERNEL32 ref: 0041B93C

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 3d3398b3f9dcf73c51e1cd00535af5d0e13f2263922661259b1695b405c8b0d4
Instruction ID: c3524ad3d233ec0a3a19b1bf7aedcb75de5af13a6c7a41cb1465cf438659ca8f
Opcode Fuzzy Hash: 3d3398b3f9dcf73c51e1cd00535af5d0e13f2263922661259b1695b405c8b0d4
Instruction Fuzzy Hash: 63E0B671120208EFCB216F65DD49AA97B79FB44751BC44439FA0586231CB39EE93CB98

Uniqueness

Uniqueness Score: -1.00%

Function 021B092B Relevance: 3.8, Strings: 3, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GetProcAddress., xrefs: 021B09DC, 021B09DF, 021B09E4
., xrefs: 021B095F
l, xrefs: 021B0966

Memory Dump Source

Source File: 00000000.00000002.310346113.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21b0000_7cduUYXDtl.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 42c187d63ad208e56e3ce7d04a141884dc5d9f54a8ed117be69e661acb09b349
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: E53148B6900609DFDB11CF99C880AEEBBF9FF4C324F15414AD845A7250D7B1EA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00404350 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(00000000,00429838,?,?,00000000,00000000), ref: 004043F2

Strings

runas, xrefs: 004043B4

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: ExecuteShell
String ID: runas
API String ID: 587946157-4000483414
Opcode ID: de7bd3c214bc239fffa76e86c4219ce5be5fd2c74372350d44addfd8b94cac34
Instruction ID: 0d432a24b2a6eecf06ea0bc45d18f5c5656229febad52b915354dd5f9442050f
Opcode Fuzzy Hash: de7bd3c214bc239fffa76e86c4219ce5be5fd2c74372350d44addfd8b94cac34
Instruction Fuzzy Hash: 56411370600208EBDB04DF69C981BDE7BB9EB45344FA0822AFC15972C0C779E984CB85

Uniqueness

Uniqueness Score: -1.00%

Function 004235FD Relevance: 13.8, APIs: 9, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004232B6: CreateFileW.KERNELBASE(00000000,00000000,?,004236A6,?,?,00000000,?,004236A6,00000000,0000000C), ref: 004232D3

GetLastError.KERNEL32 ref: 00423711
__dosmaperr.LIBCMT ref: 00423718
GetFileType.KERNELBASE(00000000), ref: 00423724
GetLastError.KERNEL32 ref: 0042372E
__dosmaperr.LIBCMT ref: 00423737
CloseHandle.KERNEL32(00000000), ref: 00423757
CloseHandle.KERNEL32(?), ref: 004238A4
GetLastError.KERNEL32 ref: 004238D6
__dosmaperr.LIBCMT ref: 004238DD

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 0d649afaf30192c5c19431845a951fd0479d0f23fa76b0b367cd72335b8b290c
Instruction ID: c7b97c56f1a0d1b911df166da15c54d720095dd6c25035754b532be6d98a6b0c
Opcode Fuzzy Hash: 0d649afaf30192c5c19431845a951fd0479d0f23fa76b0b367cd72335b8b290c
Instruction Fuzzy Hash: 7CA15872A041149FCF19DF68EC917AE3BB1AB06325F54016EF811AB391CB7C8952CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 021B003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 021B024D

Strings

kernel32.dll, xrefs: 021B008F, 021B0095
cess, xrefs: 021B018D

Memory Dump Source

Source File: 00000000.00000002.310346113.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21b0000_7cduUYXDtl.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 4ab217ea06ede6de9ba3e6b2e2a67f6ed3b7ab6b9f62452011bc74af36d61025
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: AE526974A01229DFDB65CF68C984BADBBB1BF09304F1580E9E54DAB351DB30AA85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 0041D1BB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 0041D203

Strings

HZ, xrefs: 0041D1F5
HZ, xrefs: 0041D1EE

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: _free
String ID: HZ$HZ
API String ID: 269201875-4061901197
Opcode ID: 9f5dec638c6018a6b24b976b0791b773a56ee0672529c52ab4d44372aafa3d49
Instruction ID: f1d333090dd57bfd17dfe39ecb9b07313f9b1ca465b706eabb36e918cd1afe6e
Opcode Fuzzy Hash: 9f5dec638c6018a6b24b976b0791b773a56ee0672529c52ab4d44372aafa3d49
Instruction Fuzzy Hash: 4FE0E5B6E0242022E211623F7C46AEB11856BD133AB15022FF860861E0DF7C88C2D19E

Uniqueness

Uniqueness Score: -1.00%

Function 004219A3 Relevance: 4.6, APIs: 3, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 004219AC
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00421A1A

Part of subcall function 004218BF: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,00425A80,?,00000000,00000000), ref: 00421961

Part of subcall function 0041EA8A: RtlAllocateHeap.NTDLL(00000000,?,?,?,004191D3,?,?,?,?,?,004020F3,?,?), ref: 0041EABC

_free.LIBCMT ref: 00421A0B

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: EnvironmentStrings$AllocateByteCharFreeHeapMultiWide_free
String ID:
API String ID: 2560199156-0
Opcode ID: 9bbd66b76b4a34ca0bab716a56d9e69b7f3100a2bd4ca48c1cc341373bda4218
Instruction ID: 29b21772b9320c3fddc08945695e8111c5dc75795407a2b0146b8edf9caf2341
Opcode Fuzzy Hash: 9bbd66b76b4a34ca0bab716a56d9e69b7f3100a2bd4ca48c1cc341373bda4218
Instruction Fuzzy Hash: DA01FCB2B022753B273125B73CC9DBF696DCED2BA5394013AFD04D7211EE588D0282B8

Uniqueness

Uniqueness Score: -1.00%

Function 0042356F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 004235D2

Strings

>A, xrefs: 00423571

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: _free
String ID: >A
API String ID: 269201875-3365779530
Opcode ID: 6d7cabbe3305cb9b6d011bf0e9d56addc9b4860a8407226052aa3c61f76cc774
Instruction ID: 30ff9b9e87434c0f379a7433cd06ee0227cf71fd1282e2cff9dc0eafdffef8ec
Opcode Fuzzy Hash: 6d7cabbe3305cb9b6d011bf0e9d56addc9b4860a8407226052aa3c61f76cc774
Instruction Fuzzy Hash: A8017172D00159BFCF01AFA89C01ADE7FF5AF08304F14016AB918E2151E7398B609BC4

Uniqueness

Uniqueness Score: -1.00%

Function 021B0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,021B0223,?,?), ref: 021B0E19
SetErrorMode.KERNELBASE(00000000,?,?,021B0223,?,?), ref: 021B0E1E

Memory Dump Source

Source File: 00000000.00000002.310346113.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21b0000_7cduUYXDtl.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 4bb0b02c4dfb3f5a3bc7dd2e41f8bd33247f6ec8f72617beddb3c5e3af2450fc
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: AFD0123514512877D7012A94DC09BCE7B1CDF09B66F108011FB0DD9080C770954046E5

Uniqueness

Uniqueness Score: -1.00%

Function 0041E3FF Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsopen_s.LIBCMT ref: 0041E439

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 0d6bf0a7e9f29163ed6caaa22d8f5b82bf3e75d92930a2ecd6c24ab71e07ee1e
Instruction ID: 322a9cb7d115cba5ea2c99f456cc5fe6d3c651e69e51ada78d95c10651760d14
Opcode Fuzzy Hash: 0d6bf0a7e9f29163ed6caaa22d8f5b82bf3e75d92930a2ecd6c24ab71e07ee1e
Instruction Fuzzy Hash: 14115775A0020AAFCF05DF59E9459DB7BF4EF48304F0040AAF808EB311D630EA21CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00416830 Relevance: 1.5, APIs: 1, Instructions: 36
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040CBD0: GetTempPathA.KERNEL32(00000104,?), ref: 0040B2FE

Part of subcall function 0040CBD0: GetModuleFileNameA.KERNEL32(00000000,?,00000104,3A108541), ref: 0040A7BC

Part of subcall function 00406510: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00406540

Part of subcall function 0040CBD0: GetUserNameA.ADVAPI32(?,?), ref: 0040B96E

Part of subcall function 004138B0: IsUserAnAdmin.SHELL32 ref: 0041390D
Part of subcall function 004138B0: GetUserNameA.ADVAPI32(?,?), ref: 004139B7
Part of subcall function 004138B0: GetComputerNameExW.KERNEL32(00000002,?,?,?,?), ref: 00413A20

Part of subcall function 004167E0: CreateThread.KERNEL32 ref: 004167F6
Part of subcall function 004167E0: CreateThread.KERNEL32 ref: 00416807
Part of subcall function 004167E0: CreateThread.KERNEL32 ref: 00416818
Part of subcall function 004167E0: Sleep.KERNEL32(00007530,?,00416873), ref: 00416825

InternetCloseHandle.WININET(00000000), ref: 00416887

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: Name$CreateThreadUser$FileModule$AdminCloseComputerHandleInternetPathSleepTemp
String ID:
API String ID: 1411138196-0
Opcode ID: 681845bb7bdad3a9b280c05efa4f412a3339f2d7827d3117315032cc1d5ff116
Instruction ID: fcb51b4180ac2c01cd311fc2696d032aed602c74c46a29392a881be8b31f0bff
Opcode Fuzzy Hash: 681845bb7bdad3a9b280c05efa4f412a3339f2d7827d3117315032cc1d5ff116
Instruction Fuzzy Hash: 21E08671A0050407DA043BBA5D0B64E31184F8134CF94027FB815665D7EE6DD56441FF

Uniqueness

Uniqueness Score: -1.00%

Function 0041EA8A Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,004191D3,?,?,?,?,?,004020F3,?,?), ref: 0041EABC

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: dfa22ebf96d117e5e2d1e15a0c463ff833afb46ba7fb8ad48bf3f6a11dcdaed7
Instruction ID: 5e5b785a8da04b63c94067ca99906f02eb36a9a31bcd46b4234264a7978573d4
Opcode Fuzzy Hash: dfa22ebf96d117e5e2d1e15a0c463ff833afb46ba7fb8ad48bf3f6a11dcdaed7
Instruction Fuzzy Hash: A5E0E53954012266E62126634C007DB7A48BF813F0F050037EC18962C0DB98DCC182ED

Uniqueness

Uniqueness Score: -1.00%

Function 004232B6 Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,004236A6,?,?,00000000,?,004236A6,00000000,0000000C), ref: 004232D3

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5f6f20da4e93aca7bdcb0ea2359822fb329caed46e02a9c52ac097750241beb4
Instruction ID: cd0ee65043cc83d888fb6f456493c6bde9bec702db69a9442c4f6e90f97d0004
Opcode Fuzzy Hash: 5f6f20da4e93aca7bdcb0ea2359822fb329caed46e02a9c52ac097750241beb4
Instruction Fuzzy Hash: 77D06C3210010DFFDF128F84DC06EDA3BAAFB48724F414120BA1856020C732E872EB94

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00402C70 Relevance: 51.7, APIs: 28, Strings: 1, Instructions: 910registrywindowfileCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,3A108541,3A108541), ref: 00402E1C
RegQueryValueExA.ADVAPI32(3A108541,?,00000000,00000000,?,00000400,?,?,00000000,00000001,3A108541,3A108541), ref: 00402E4A
RegCloseKey.ADVAPI32(3A108541,?,?,00000000,00000001,3A108541,3A108541), ref: 00402E56
RegOpenKeyExA.ADVAPI32(80000001,80000001,00000000,000F003F,00000001), ref: 00402F63
RegSetValueExA.ADVAPI32(80000001,?,00000000,00000002,?,?), ref: 00402F91
RegCloseKey.ADVAPI32(80000001), ref: 00402F9A
GdiplusStartup.GDIPLUS(?,?,00000000,3A108541), ref: 004030CA
GetDC.USER32(00000000), ref: 004031C2
RegGetValueA.ADVAPI32(80000002,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000004), ref: 00403449
GetSystemMetrics.USER32 ref: 004034A2
GetSystemMetrics.USER32 ref: 004034AB
RegGetValueA.ADVAPI32(80000002,?,00000000), ref: 004034F3
GetSystemMetrics.USER32 ref: 00403546
GetSystemMetrics.USER32 ref: 0040354F
CreateCompatibleDC.GDI32(?), ref: 0040355B
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00403570
SelectObject.GDI32(00000000,00000000), ref: 00403580
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 004035A6
GdipCreateBitmapFromHBITMAP.GDIPLUS(00000000,00000000,?), ref: 004035BA
GdipGetImageEncodersSize.GDIPLUS(00000000,?), ref: 004035D6
GdipGetImageEncoders.GDIPLUS(00000000,00000000,00000000), ref: 00403603
GdipSaveImageToFile.GDIPLUS(00000000,?,?,00000000), ref: 00403687
SelectObject.GDI32(00000000,?), ref: 00403694
DeleteObject.GDI32(00000000), ref: 004036A1
DeleteObject.GDI32(?), ref: 004036A9
ReleaseDC.USER32 ref: 004036B3
GdipDisposeImage.GDIPLUS(00000000), ref: 004036BA
GdiplusShutdown.GDIPLUS(?), ref: 0040375C

Strings

image/jpeg, xrefs: 00403615

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: Gdip$ImageMetricsObjectSystemValue$Create$BitmapCloseCompatibleDeleteEncodersGdiplusOpenSelect$DisposeFileFromQueryReleaseSaveShutdownSizeStartup
String ID: image/jpeg
API String ID: 406439762-3785015651
Opcode ID: 980cba627aba57c3be443a91d8b4af89879fdcee3fb983424af2fc9b42805253
Instruction ID: ef3e356fa5e9885fc08513456cc6264c1fb040e0d3da28046e10bcebe11668ea
Opcode Fuzzy Hash: 980cba627aba57c3be443a91d8b4af89879fdcee3fb983424af2fc9b42805253
Instruction Fuzzy Hash: A362F471A00108ABEB18DF28CD85BDDBB76EF45304F50826EE805B72D1DB799A85CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00403F40 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 162injectionthreadmemoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00403F66
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00403FCB
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00403FE4
GetThreadContext.KERNEL32(?,00000000), ref: 00403FFF
ReadProcessMemory.KERNEL32(?, ,?,00000004,00000000), ref: 00404023
GetModuleHandleA.KERNEL32(ntdll.dll,NtUnmapViewOfSection), ref: 0040403E
GetProcAddress.KERNEL32(00000000), ref: 00404045
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 0040406D
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 0040408E
WriteProcessMemory.KERNEL32(?,?,?,?,00000000,?,?,00000000), ref: 004040D2
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,00000000), ref: 0040410E
SetThreadContext.KERNEL32(?,00000000,?,?,00000000), ref: 0040412A
ResumeThread.KERNEL32(?,?,?,00000000), ref: 00404136
VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000), ref: 00404144
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00404165

Strings

NtUnmapViewOfSection, xrefs: 00404034
, xrefs: 00404018
ntdll.dll, xrefs: 00404039

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: Process$MemoryVirtual$ThreadWrite$AllocContextFreeModule$AddressCreateFileHandleNameProcReadResume
String ID: $NtUnmapViewOfSection$ntdll.dll
API String ID: 4033543172-1522589568
Opcode ID: 2fc5be1b3ec4d92441bc9103c4f92097ff01d4c177745f7de35fcca25cf32f0a
Instruction ID: 7185e54e9f5f5e6bc342fc5ffd2bfcf32a837d4cfdcfbf42461452ed81247528
Opcode Fuzzy Hash: 2fc5be1b3ec4d92441bc9103c4f92097ff01d4c177745f7de35fcca25cf32f0a
Instruction Fuzzy Hash: 66518971600218EBDB209F54DC49FEAB7B8FF48701F9040B6F708AA291D7B1A995CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004037D0 Relevance: 27.2, APIs: 18, Instructions: 210memoryCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 00403822
GetProcessHeap.KERNEL32(00000008,?), ref: 00403837
HeapAlloc.KERNEL32(00000000), ref: 0040383A
GetUserNameW.ADVAPI32(00000000,?), ref: 00403848
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 0040386B
GetProcessHeap.KERNEL32(00000008,?), ref: 00403876
HeapAlloc.KERNEL32(00000000), ref: 00403879
GetProcessHeap.KERNEL32(00000008,?), ref: 00403889
HeapAlloc.KERNEL32(00000000), ref: 0040388C
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 004038B6
ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 004038C9
GetProcessHeap.KERNEL32(00000000,?), ref: 004039C5
HeapFree.KERNEL32(00000000), ref: 004039CE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004039D3
HeapFree.KERNEL32(00000000), ref: 004039D6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004039DD
HeapFree.KERNEL32(00000000), ref: 004039E0
LocalFree.KERNEL32(00000000), ref: 004039E5

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: Heap$Process$FreeName$Alloc$AccountLookupUser$ConvertLocalString
String ID:
API String ID: 3326663573-0
Opcode ID: a64e29b37d9ba5868eb87ff9c3c3dad53cd4cde0e11c70c606b7e5db171cbd47
Instruction ID: 167f534f4a5bc3f8c65bdd595c5ec8e1d54d44385eb9c59962b1969d814595bf
Opcode Fuzzy Hash: a64e29b37d9ba5868eb87ff9c3c3dad53cd4cde0e11c70c606b7e5db171cbd47
Instruction Fuzzy Hash: EA716DB1E00209ABDB14DFA5DC85BEFBBBCEB48300F40453AE905A7281DB749905CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 021B41A7 Relevance: 22.7, APIs: 15, Instructions: 162injectionthreadmemoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 021B41CD
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 021B4232
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 021B424B
GetThreadContext.KERNEL32(?,00000000), ref: 021B4266
ReadProcessMemory.KERNEL32(?,00434ECC,?,00000004,00000000), ref: 021B428A
GetModuleHandleA.KERNEL32(00434EE8,00434ED0), ref: 021B42A5
GetProcAddress.KERNEL32(00000000), ref: 021B42AC
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 021B42D4
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 021B42F5
WriteProcessMemory.KERNEL32(?,?,?,?,00000000,?,?,00000000), ref: 021B4339
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,00000000), ref: 021B4375
SetThreadContext.KERNEL32(?,00000000,?,?,00000000), ref: 021B4391
ResumeThread.KERNEL32(?,?,?,00000000), ref: 021B439D
VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000), ref: 021B43AB
VirtualFree.KERNEL32(?,00000000,00008000), ref: 021B43CC

Memory Dump Source

Source File: 00000000.00000002.310346113.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21b0000_7cduUYXDtl.jbxd

Yara matches

Similarity

API ID: Process$MemoryVirtual$ThreadWrite$AllocContextFreeModule$AddressCreateFileHandleNameProcReadResume
String ID:
API String ID: 4033543172-0
Opcode ID: 2fc5be1b3ec4d92441bc9103c4f92097ff01d4c177745f7de35fcca25cf32f0a
Instruction ID: 1d46b11d3f52570259211867d22ff1d0f2f3affcad409e27af4df32e5424d0bc
Opcode Fuzzy Hash: 2fc5be1b3ec4d92441bc9103c4f92097ff01d4c177745f7de35fcca25cf32f0a
Instruction Fuzzy Hash: 65517C71A40218AFDB219F54DC45FEAB7B8FF08705F9040B5F608EA2A1D7B1A994CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00404180 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 166networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(00434EF4,00000000,00000000,00000000,00000000), ref: 0040425C
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040426E
InternetReadFile.WININET(00000000,?,03E80000,03E80000), ref: 00404281
InternetCloseHandle.WININET(00000000), ref: 00404292
InternetCloseHandle.WININET(00000000), ref: 00404295
InternetCloseHandle.WININET(00000000), ref: 004042A3
InternetCloseHandle.WININET(00000000), ref: 004042A6

Strings

runas, xrefs: 004043B4

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: Internet$CloseHandle$Open$FileRead
String ID: runas
API String ID: 4294395943-4000483414
Opcode ID: 28ce16dc81a2aff0cf4c6fac810d51fc3cde5d363382f25497ed73183f804a84
Instruction ID: ba1dc25ec83469701d4c7edc2e7ba4793e46b241d410edfdecdbeb0a0fce58bd
Opcode Fuzzy Hash: 28ce16dc81a2aff0cf4c6fac810d51fc3cde5d363382f25497ed73183f804a84
Instruction Fuzzy Hash: 4951D571E00108ABDB14DFA4DC41BEEBB75EF85300F60816EF915B7291D7389945CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00424BC4 Relevance: 7.9, APIs: 5, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00424C46
_free.LIBCMT ref: 00424C6A
_free.LIBCMT ref: 00424DF7
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,004335D8), ref: 00424E09
_free.LIBCMT ref: 00424FC3

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: 8c2b88b9d242ee917946bc58aad9aca9963a64eab752d66957554f7044879769
Instruction ID: 2c4f844ee906d1c5b8a05b7d4d89c1c9074c071bb98950a21f89e01ce9d05ddf
Opcode Fuzzy Hash: 8c2b88b9d242ee917946bc58aad9aca9963a64eab752d66957554f7044879769
Instruction Fuzzy Hash: 1FC17835B00128ABDB209F69EC41BAB7BA9EFC5354F94416FE550D7381E7388E01CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00405400 Relevance: 6.2, APIs: 4, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,3A108541,00000000), ref: 00405479
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004054E0
GetProcAddress.KERNEL32(00000000), ref: 004054E7

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: AddressHandleModuleProcVersion
String ID:
API String ID: 3310240892-0
Opcode ID: 40c6cdebbb456b066a3f68f0887994b65a3b830430b2fa73f4ce35f146c3d2be
Instruction ID: 1307c1e28f23caf99c3cad6e9d6b2b61846357279e254348caa37701d54b456e
Opcode Fuzzy Hash: 40c6cdebbb456b066a3f68f0887994b65a3b830430b2fa73f4ce35f146c3d2be
Instruction Fuzzy Hash: B8513971900608ABDB14DB24DD497DE7B76EB46314F5042BAE805B73C1DB389EC48F99

Uniqueness

Uniqueness Score: -1.00%

Function 0041CA80 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0041CB78
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0041CB82
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0041CB8F

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d01e7f133785e3bb0beafcf269aef2531f9dd5a62572b740f5956f5575e894ef
Instruction ID: ff4d1174fdddd5ebc348feb1509e890b27b9c9d6be8b5b558b14357fec343526
Opcode Fuzzy Hash: d01e7f133785e3bb0beafcf269aef2531f9dd5a62572b740f5956f5575e894ef
Instruction Fuzzy Hash: 8C31A275901228ABCB21DF65D989BD9BBB8AF08310F5041EAE40CA6251EB749F858F58

Uniqueness

Uniqueness Score: -1.00%

Function 0042848D Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00428488,?,?,00000008,?,?,00428120,00000000), ref: 004286BA

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 5ef4d00b5429483db4ee21fa4326bc925bf0c13a1e125d06c7f23f728c6050ca
Instruction ID: 4a71125e6f4c823a3763720cf76552cabfd479d0aa9e4c8b08dce5cb0b77843e
Opcode Fuzzy Hash: 5ef4d00b5429483db4ee21fa4326bc925bf0c13a1e125d06c7f23f728c6050ca
Instruction Fuzzy Hash: 39B17B31211618DFD714CF28D48AB697BA0FF44364F65865DE89ACF3A1CB39E982CB44

Uniqueness

Uniqueness Score: -1.00%

Function 021D86F4 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,021D86EF,?,?,00000008,?,?,021D8387,00000000), ref: 021D8921

Memory Dump Source

Source File: 00000000.00000002.310346113.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21b0000_7cduUYXDtl.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 5ef4d00b5429483db4ee21fa4326bc925bf0c13a1e125d06c7f23f728c6050ca
Instruction ID: e6a96c671b615ff1a0085192bcda776dbefced95832755768cbeca0a83317c13
Opcode Fuzzy Hash: 5ef4d00b5429483db4ee21fa4326bc925bf0c13a1e125d06c7f23f728c6050ca
Instruction Fuzzy Hash: 82B14D31650605DFD719CF2CC48AB657BA0FF45368F268658E8EACF2A1C335E992CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00418887 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0041889D

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: d55505ce439c0c625bb69c877a6f4797faed7c5d0db0f84db7aa582d50e4da23
Instruction ID: 42c5aa6f6f7fc7f776cec8504a7906bb6cf0d019190ab3c9283af4763153d71d
Opcode Fuzzy Hash: d55505ce439c0c625bb69c877a6f4797faed7c5d0db0f84db7aa582d50e4da23
Instruction Fuzzy Hash: 92516AB2A10215CBDB18CF65D9817AEBBF4FB48314F24942BD445EB350D7789980CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00420BA6 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d97f7f4797c3a364c903861215189f8d8653831c5c514b3b47f127515a30102c
Instruction ID: 995ca3f643b73f20b77409ea83fcee654ff77a15ad0f1f03090dea471df43cee
Opcode Fuzzy Hash: d97f7f4797c3a364c903861215189f8d8653831c5c514b3b47f127515a30102c
Instruction Fuzzy Hash: FE41C4B5904228AEDB24DF69DC89AEABBB8EF45304F5442DEE40DD3211DA349E848F54

Uniqueness

Uniqueness Score: -1.00%

Function 00418BCC Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00018BD8,004186D1), ref: 00418BD1

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 5b644bd4298714589124608af917b149a8cdb7aa3ad9eb7150b270449828aa51
Instruction ID: fb13876baf3060654c4d3ec658a032312c050c0c5ceb920d56ad85ce90fc2474
Opcode Fuzzy Hash: 5b644bd4298714589124608af917b149a8cdb7aa3ad9eb7150b270449828aa51
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00432890 Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a3a9157b277817cb60641082f1e4f8ca4ec7dff310ffa31a6fd9bf35832d5c1
Instruction ID: 2ed8bcd71233cdd26d40d40588c8b3db03f02c46a7ead0be40a967f157380f8c
Opcode Fuzzy Hash: 5a3a9157b277817cb60641082f1e4f8ca4ec7dff310ffa31a6fd9bf35832d5c1
Instruction Fuzzy Hash: F3E1875548E3C15FD7138B3449B5681BF70AE23114B1E96DBCCDA8E4A7D24CAA0EE732

Uniqueness

Uniqueness Score: -1.00%

Function 00429470 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 836b6cb189818071d5d152d6c3d8cd1a25b1ac1f9bf822a59482dcdb2b2a5351
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 3B115B7730407157D605DA3DF8B46BBA395EFC9320FAC437BC0424B748D22A9C839508

Uniqueness

Uniqueness Score: -1.00%

Function 021D96D7 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.310346113.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21b0000_7cduUYXDtl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 3d154fef5ed125ed344dc961b8a30b049b66235cab7742b4724df85a5bb628ae
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 8C1127BB2C1091C3DA188E2DD9F42FBA799EBC6128F2D4B7AD0524B758D322E145DE00

Uniqueness

Uniqueness Score: -1.00%

Function 0041DF02 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ad719187851a61f309ddbb2cee80a5110ae42387cecf94a10a94091515ac20
Instruction ID: 75fb159916dc4249806a39f04cce895c1ac82e6549e7b4276809d1188ffe9861
Opcode Fuzzy Hash: e0ad719187851a61f309ddbb2cee80a5110ae42387cecf94a10a94091515ac20
Instruction Fuzzy Hash: 70E046B2921228EBCB24DF8999049CAF3ECEB49B04B2100AAB502D3200C274DF41C7D4

Uniqueness

Uniqueness Score: -1.00%

Function 021CE169 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.310346113.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21b0000_7cduUYXDtl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ad719187851a61f309ddbb2cee80a5110ae42387cecf94a10a94091515ac20
Instruction ID: 4130ff2a68440bdd99f9cda329df6ae24a6ce12e71ac38b8fe3773f55551b3a8
Opcode Fuzzy Hash: e0ad719187851a61f309ddbb2cee80a5110ae42387cecf94a10a94091515ac20
Instruction Fuzzy Hash: C1E08C32951268EBCB18DB98D90498AF7FEEB44B14B2144AAB501E3200C370DE00CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0042260F Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00422653

Part of subcall function 004221EC: _free.LIBCMT ref: 00422209
Part of subcall function 004221EC: _free.LIBCMT ref: 0042221B
Part of subcall function 004221EC: _free.LIBCMT ref: 0042222D
Part of subcall function 004221EC: _free.LIBCMT ref: 0042223F
Part of subcall function 004221EC: _free.LIBCMT ref: 00422251
Part of subcall function 004221EC: _free.LIBCMT ref: 00422263
Part of subcall function 004221EC: _free.LIBCMT ref: 00422275
Part of subcall function 004221EC: _free.LIBCMT ref: 00422287
Part of subcall function 004221EC: _free.LIBCMT ref: 00422299
Part of subcall function 004221EC: _free.LIBCMT ref: 004222AB
Part of subcall function 004221EC: _free.LIBCMT ref: 004222BD
Part of subcall function 004221EC: _free.LIBCMT ref: 004222CF
Part of subcall function 004221EC: _free.LIBCMT ref: 004222E1

_free.LIBCMT ref: 00422648

Part of subcall function 0041E5A1: HeapFree.KERNEL32(00000000,00000000,?,0042237D,?,00000000,?,?,?,004223A4,?,00000007,?,?,004227A6,?), ref: 0041E5B7
Part of subcall function 0041E5A1: GetLastError.KERNEL32(?,?,0042237D,?,00000000,?,?,?,004223A4,?,00000007,?,?,004227A6,?,?), ref: 0041E5C9

_free.LIBCMT ref: 0042266A
_free.LIBCMT ref: 0042267F
_free.LIBCMT ref: 0042268A
_free.LIBCMT ref: 004226AC
_free.LIBCMT ref: 004226BF
_free.LIBCMT ref: 004226CD
_free.LIBCMT ref: 004226D8
_free.LIBCMT ref: 00422710
_free.LIBCMT ref: 00422717
_free.LIBCMT ref: 00422734
_free.LIBCMT ref: 0042274C

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 2ebc8ac26202a0620aa625b36a1d2a8fe7bc692bad1c871fd446d657effbc3a9
Instruction ID: 87a383156b0838ac626f9c2c6038cf6ce1f5ffd7cd3d592d57855f9c4539c293
Opcode Fuzzy Hash: 2ebc8ac26202a0620aa625b36a1d2a8fe7bc692bad1c871fd446d657effbc3a9
Instruction Fuzzy Hash: B6319272604211BFEB205A76EA45B9B73E5AF80358F50441FE849D7251DFBCED80DB18

Uniqueness

Uniqueness Score: -1.00%

Function 00419B27 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00419C22
type_info::operator==.LIBVCRUNTIME ref: 00419C49
___TypeMatch.LIBVCRUNTIME ref: 00419D55
IsInExceptionSpec.LIBVCRUNTIME ref: 00419E30
_UnwindNestedFrames.LIBCMT ref: 00419EB7
CallUnexpected.LIBVCRUNTIME ref: 00419ED2

Strings

csm, xrefs: 00419B62
csm, xrefs: 00419C80
csm, xrefs: 00419BCF

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 7c1fb931e7428280153d6c09b5a5c630754522480dfed903c9c8a59691bc5c1e
Instruction ID: d03aefa22aee8cf5aa416bea0a170c685dbf4c7cd79984a2e6415da9b3a38480
Opcode Fuzzy Hash: 7c1fb931e7428280153d6c09b5a5c630754522480dfed903c9c8a59691bc5c1e
Instruction Fuzzy Hash: 49C18871900209EFCF29DFA5D8A19EEBBB5BF04314F14405BE8516B242D339DE91CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00421A27 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00421A51
_free.LIBCMT ref: 00421B2A
_free.LIBCMT ref: 00421B57

Strings

HZ, xrefs: 00421A78, 00421AB7, 00421AC4, 00421AFB, 00421BC3

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: _free$___from_strstr_to_strchr
String ID: HZ
API String ID: 3409252457-879387849
Opcode ID: 17a2c5d05d88992eb6c4295c13d4ba7d46687f58b453e92c494b9aad345095be
Instruction ID: f188bb2de727b7b751c2d84351da10a70f250225146cef8743706f99745805fe
Opcode Fuzzy Hash: 17a2c5d05d88992eb6c4295c13d4ba7d46687f58b453e92c494b9aad345095be
Instruction Fuzzy Hash: 0E518C74F44324AFDB24AFB7A881A6E7BB4AF11314F54416FE410972A1EA3D8940CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00408B5C Relevance: 15.2, APIs: 10, Instructions: 219networkfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00408BAC
InternetOpenA.WININET(0043432B,00000000,00000000,00000000,00000000), ref: 00408BC2
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00408BE2
InternetReadFile.WININET(00000000,00000000,?,?), ref: 00408BF3
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00408C15
InternetReadFile.WININET(00000000,00000000,?,?), ref: 00408C20
CloseHandle.KERNEL32(?), ref: 00408C32
InternetCloseHandle.WININET(?), ref: 00408C41
InternetCloseHandle.WININET(00000000), ref: 00408C44
RemoveDirectoryA.KERNEL32(00000000,?,?,?), ref: 00408CFD

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: Internet$File$CloseHandle$OpenRead$CreateDirectoryRemoveWrite
String ID:
API String ID: 1496009958-0
Opcode ID: d4071f3938f2969eb82609d0eef3df7d35d4587525f7ef1aeed542a422f625c7
Instruction ID: e39da941a42be4000a8416f9d2a6f8c848e32a180712f45a109694aa4e2734ce
Opcode Fuzzy Hash: d4071f3938f2969eb82609d0eef3df7d35d4587525f7ef1aeed542a422f625c7
Instruction Fuzzy Hash: 6E71EF71600208ABEB14DF64DD85BEE7735EF44304F50423EF945AB2D1DB38A980CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0041ED7A Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041ED90

Part of subcall function 0041E5A1: HeapFree.KERNEL32(00000000,00000000,?,0042237D,?,00000000,?,?,?,004223A4,?,00000007,?,?,004227A6,?), ref: 0041E5B7
Part of subcall function 0041E5A1: GetLastError.KERNEL32(?,?,0042237D,?,00000000,?,?,?,004223A4,?,00000007,?,?,004227A6,?,?), ref: 0041E5C9

_free.LIBCMT ref: 0041ED9C
_free.LIBCMT ref: 0041EDA7
_free.LIBCMT ref: 0041EDB2
_free.LIBCMT ref: 0041EDBD
_free.LIBCMT ref: 0041EDC8
_free.LIBCMT ref: 0041EDD3
_free.LIBCMT ref: 0041EDDE
_free.LIBCMT ref: 0041EDE9
_free.LIBCMT ref: 0041EDF7

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b518f20b764996853f57fbd2a3fdc4e7bf3deb810a08f9cd0b2a52dd965201da
Instruction ID: e610bd300bd5c2f85586062e27af9f16ff799e012d6f089a2169b26ee7872c24
Opcode Fuzzy Hash: b518f20b764996853f57fbd2a3fdc4e7bf3deb810a08f9cd0b2a52dd965201da
Instruction Fuzzy Hash: ED219CBA910108BFCB41EF96C941DDD7BF6BF88344F00416AF9199B121EB35DA84DB84

Uniqueness

Uniqueness Score: -1.00%

Function 00426582 Relevance: 13.8, APIs: 9, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a78892049de11e46c50fbd2fa855718c5aabf05d02eef10ffa1756f3991459e
Instruction ID: 5128a0cef717139e7719faf6ed0b9fe75c650819d7ce78bb109199c1610a9dbc
Opcode Fuzzy Hash: 1a78892049de11e46c50fbd2fa855718c5aabf05d02eef10ffa1756f3991459e
Instruction Fuzzy Hash: D3C114B4B002159FDF11DF99E880BAEBBB0BF49304F51406AE914A7382C7789D81CF69

Uniqueness

Uniqueness Score: -1.00%

Function 021D67E9 Relevance: 13.8, APIs: 9, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.310346113.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21b0000_7cduUYXDtl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5ce67aa41b5f7f4889b1a1a20be5028291e55dfd00ef2a2d6d7ad31bcea8bed
Instruction ID: 6dbd2c5e423e334920103486c0eadda1295b5f54b8e7a96b186c83aed40998b5
Opcode Fuzzy Hash: f5ce67aa41b5f7f4889b1a1a20be5028291e55dfd00ef2a2d6d7ad31bcea8bed
Instruction Fuzzy Hash: F1C14674E84285EFDF24CF98E880BADBBB9BF48304F148069E59497391C7349941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00426FA9 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 244COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,7FFFFFFF,?,HZ,00427265,?,?,?,?,?,?,?,?,HZ), ref: 0042704C
__alloca_probe_16.LIBCMT ref: 00427102
__alloca_probe_16.LIBCMT ref: 00427198
__freea.LIBCMT ref: 00427203
__freea.LIBCMT ref: 0042720F

Strings

HZ, xrefs: 00426FAB

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: __alloca_probe_16__freea$Info
String ID: HZ
API String ID: 2330168043-879387849
Opcode ID: 5f2a50e45296c4ab9ea81c751da5de9d4fb401d4688c96eb67b443e93606af8c
Instruction ID: f6d9b8f12c634194a1b411eace1e19527ea88e01b30f60a4b5a6e0b516c13e2d
Opcode Fuzzy Hash: 5f2a50e45296c4ab9ea81c751da5de9d4fb401d4688c96eb67b443e93606af8c
Instruction Fuzzy Hash: 4481E472B082259BDF219EA5AC41EEF7BB5EF09354F98005BF804A7341D62DCC458BB9

Uniqueness

Uniqueness Score: -1.00%

Function 004194D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00419507
___except_validate_context_record.LIBVCRUNTIME ref: 0041950F
_ValidateLocalCookies.LIBCMT ref: 00419598
__IsNonwritableInCurrentImage.LIBCMT ref: 004195C3
_ValidateLocalCookies.LIBCMT ref: 00419618

Strings

csm, xrefs: 004195AD

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 170db4f13a52bbc04fbb15fe7ab42c90d24a7c19ae8ceb0e3c19913b98646896
Instruction ID: cf6a3be1c1e6f4323defd25786acadca5afaa418f9c93884064ec3a043526e94
Opcode Fuzzy Hash: 170db4f13a52bbc04fbb15fe7ab42c90d24a7c19ae8ceb0e3c19913b98646896
Instruction Fuzzy Hash: 09411A31A00214AFCF11DF69C890ADEBBB1BF45318F54806BE8146B352D739DE96CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041F14C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 0041F1A3
ext-ms-, xrefs: 0041F1B7

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: d346eea9aafd959945e16ecfc9ebbe047e966c499b5e8e0d3b3e0bbc48b51e8c
Instruction ID: 8946f5363388c355846af12649c4142b4e9cf4c5f65ba016e67a922269825e5f
Opcode Fuzzy Hash: d346eea9aafd959945e16ecfc9ebbe047e966c499b5e8e0d3b3e0bbc48b51e8c
Instruction Fuzzy Hash: 3521C672A41221FBCB318A24DC45A9B3778AB017A0F650532ED15A7391D638ED4BC5DC

Uniqueness

Uniqueness Score: -1.00%

Function 0042238B Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00422353: _free.LIBCMT ref: 00422378

_free.LIBCMT ref: 004223D9

Part of subcall function 0041E5A1: HeapFree.KERNEL32(00000000,00000000,?,0042237D,?,00000000,?,?,?,004223A4,?,00000007,?,?,004227A6,?), ref: 0041E5B7
Part of subcall function 0041E5A1: GetLastError.KERNEL32(?,?,0042237D,?,00000000,?,?,?,004223A4,?,00000007,?,?,004227A6,?,?), ref: 0041E5C9

_free.LIBCMT ref: 004223E4
_free.LIBCMT ref: 004223EF
_free.LIBCMT ref: 00422443
_free.LIBCMT ref: 0042244E
_free.LIBCMT ref: 00422459
_free.LIBCMT ref: 00422464

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 745ba4c7df38b0c8b3501d58b22aa89868de86b005191e755d783c3d27d16807
Instruction ID: 3666b1e76cecdb1a9706d82e7bd79ae187b091a1e89744abee2c0a3d449e73e2
Opcode Fuzzy Hash: 745ba4c7df38b0c8b3501d58b22aa89868de86b005191e755d783c3d27d16807
Instruction Fuzzy Hash: C611E471601714BAD921F7B2DD47FCB77DD5F0834CF84881EBACD6A052D6ACB6514604

Uniqueness

Uniqueness Score: -1.00%

Function 00423A46 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00405880,00000000), ref: 00423A8E
__fassign.LIBCMT ref: 00423C6D
__fassign.LIBCMT ref: 00423C8A
WriteFile.KERNEL32(?,00405880,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00423CD2
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00423D12
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00423DBE

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 5a0c35df1f21bdc5310913443ad541efee69954072d07ce9ea6e444a121a2afd
Instruction ID: 55294dd1ed643e62d688e25fe7fc8b93d32e6dca02253c809cdcf0ede3e7f937
Opcode Fuzzy Hash: 5a0c35df1f21bdc5310913443ad541efee69954072d07ce9ea6e444a121a2afd
Instruction Fuzzy Hash: 21D1A075E002689FCF15CFA8D8809EDBBB5BF48314F64016AE455FB342D738AA46CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004197F0 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,004197E7,004193D7,00418C1C), ref: 004197FE
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0041980C
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00419825
SetLastError.KERNEL32(00000000,004197E7,004193D7,00418C1C), ref: 00419877

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 0f6e51aa0c255468b6a622d8c735b9b5b069fdda8c7ed9770d7dbe64c9198e0d
Instruction ID: 71a7697fc03e6214697c45e1a132a8316019e6706060db725442c6d2a3e753c8
Opcode Fuzzy Hash: 0f6e51aa0c255468b6a622d8c735b9b5b069fdda8c7ed9770d7dbe64c9198e0d
Instruction Fuzzy Hash: F101D8326293115EE62C3B76AE959D72774EF067B8720023FF120441F1EF594C95D58D

Uniqueness

Uniqueness Score: -1.00%

Function 021B43E7 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 166networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(00434EF4,00000000,00000000,00000000,00000000), ref: 021B44C3
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 021B44D5
InternetReadFile.WININET(00000000,?,03E80000,03E80000), ref: 021B44E8

Strings

runas, xrefs: 021B461B
+CC, xrefs: 021B4621

Memory Dump Source

Source File: 00000000.00000002.310346113.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21b0000_7cduUYXDtl.jbxd

Yara matches

Similarity

API ID: Internet$Open$FileRead
String ID: +CC$runas
API String ID: 72386350-2150734417
Opcode ID: f629ccd115f1b0a5505da88cd8cf5212883000edcb5ff7f417580e889bd18442
Instruction ID: b42de23b00c3ba79b0cb9973b94e1d23742d4eee82cb20f76ec8255ed512fda2
Opcode Fuzzy Hash: f629ccd115f1b0a5505da88cd8cf5212883000edcb5ff7f417580e889bd18442
Instruction Fuzzy Hash: 3651D172E40108AFDB15DFA8CC91FEEBBB6EF58700F608129E411A7681D775A944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041CE88 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 123COMMON

Download Yara Rule

Strings

X3Z, xrefs: 0041CED9
P}], xrefs: 0041CF5D, 0041CFA0
C:\Users\user\Desktop\7cduUYXDtl.exe, xrefs: 0041CECB, 0041CED2, 0041CF08

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\7cduUYXDtl.exe$P}]$X3Z
API String ID: 0-3247073527
Opcode ID: 31fa4e4f4f0bc981144b5b3ffc5fea1ddf45f4662b4ea0433f5b95f05539bbed
Instruction ID: 3e019bb9f1f37e8f56b3af26f626c64f14fa1fa210d5d8f79d997b38734a4c96
Opcode Fuzzy Hash: 31fa4e4f4f0bc981144b5b3ffc5fea1ddf45f4662b4ea0433f5b95f05539bbed
Instruction Fuzzy Hash: 9A41A271A80214AFDB11DF9A9CC19EFBBB9EB85710F10006BF40497251D7788E82CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00420F7C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\7cduUYXDtl.exe, xrefs: 00420F81

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\7cduUYXDtl.exe
API String ID: 0-3414761971
Opcode ID: d9fd3d3f386e086f16d5e96c86dfc6c05a3e177acafcacdda8c025444d2164cb
Instruction ID: f2c65a4c72dcbe00dc32dc221c8eb50b3435d1ebdf66b1fbb5bbc6e11338d05a
Opcode Fuzzy Hash: d9fd3d3f386e086f16d5e96c86dfc6c05a3e177acafcacdda8c025444d2164cb
Instruction Fuzzy Hash: CB210A713001257F97206F71ED81D6BB7ADAF103A8750462BF828D7691D778DC818799

Uniqueness

Uniqueness Score: -1.00%

Function 021D11E3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\7cduUYXDtl.exe, xrefs: 021D11E8

Memory Dump Source

Source File: 00000000.00000002.310346113.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21b0000_7cduUYXDtl.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\7cduUYXDtl.exe
API String ID: 0-3414761971
Opcode ID: 58ea943009bd374bebf7ec5987a08b3fa813e305a807f4d2fcbf4f6ae6d6cbf6
Instruction ID: c35d40198e5c3b5f3bd7aa6f20ca5657531313a631f7881eca3bea2874a43164
Opcode Fuzzy Hash: 58ea943009bd374bebf7ec5987a08b3fa813e305a807f4d2fcbf4f6ae6d6cbf6
Instruction Fuzzy Hash: F6219276A84105FF9B24AF65DC80F6B776EAF103647204629E92CD7550E732EC018FA0

Uniqueness

Uniqueness Score: -1.00%

Function 0041C3D6 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 0041C418

Strings

.cmd, xrefs: 0041C436
.bat, xrefs: 0041C447
.com, xrefs: 0041C458
.exe, xrefs: 0041C425

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 19671788b65354572937ca0f5259cacd468799deb2890a42aa5f1fe1ebfecd1d
Instruction ID: baa428b651ab7fadd2aefce0a8d8cefe58070258f098f4f191bca89b56dcb2ea
Opcode Fuzzy Hash: 19671788b65354572937ca0f5259cacd468799deb2890a42aa5f1fe1ebfecd1d
Instruction Fuzzy Hash: 7E012B3BA8C635212624101AEC62BF717988B96FB8B25412FF854F72C1ED9DEC8205DC

Uniqueness

Uniqueness Score: -1.00%

Function 0041A897 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 0041A8E7

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: d7b12ed5c3c764c8b82cc7f1cf76b5788b814adb9963f19d14a8505e8bb0b4a8
Instruction ID: 8addbc20e8b4f1572ca5f78bff053ba989236767de5a1c4d832f47c373f0c560
Opcode Fuzzy Hash: d7b12ed5c3c764c8b82cc7f1cf76b5788b814adb9963f19d14a8505e8bb0b4a8
Instruction Fuzzy Hash: 2B112C71A12221EBC7314B249D44AAB37689F017B4B624933ED45AB390D738DDE1C5DE

Uniqueness

Uniqueness Score: -1.00%

Function 0041B943 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,0041B938,?,?,0041B900,0041BE86,?,NA), ref: 0041B958
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0041B96B
FreeLibrary.KERNEL32(00000000,?,?,0041B938,?,?,0041B900,0041BE86,?,NA), ref: 0041B98E

Strings

CorExitProcess, xrefs: 0041B963
mscoree.dll, xrefs: 0041B951

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: af14fd2dde53d7be7e540de01eeb28501674720f1683c90e0ca13ac16e635f3d
Instruction ID: 6ab08718997dcf592451d77b1cbf540418157bbc441c253cf8170436862d5d78
Opcode Fuzzy Hash: af14fd2dde53d7be7e540de01eeb28501674720f1683c90e0ca13ac16e635f3d
Instruction Fuzzy Hash: 52F08230651218FBDB259B50DD0ABEEBA78DF44759F900175A504A1260CB788E46DA98

Uniqueness

Uniqueness Score: -1.00%

Function 0041D819 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041D822

Part of subcall function 0041E5A1: HeapFree.KERNEL32(00000000,00000000,?,0042237D,?,00000000,?,?,?,004223A4,?,00000007,?,?,004227A6,?), ref: 0041E5B7
Part of subcall function 0041E5A1: GetLastError.KERNEL32(?,?,0042237D,?,00000000,?,?,?,004223A4,?,00000007,?,?,004227A6,?,?), ref: 0041E5C9

_free.LIBCMT ref: 0041D835
_free.LIBCMT ref: 0041D846
_free.LIBCMT ref: 0041D857

Strings

P}], xrefs: 0041D851

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: P}]
API String ID: 776569668-481746256
Opcode ID: 5b4b832eec97106c71e74c3abf3533cea5e390173416251ec6b9798646083543
Instruction ID: 2f128d3171f244c94fc48b8332bc88089a284fec835ab8af747093701a289460
Opcode Fuzzy Hash: 5b4b832eec97106c71e74c3abf3533cea5e390173416251ec6b9798646083543
Instruction Fuzzy Hash: C3E04FB4801520AFCE012F53FE055953BA2FB947EC340302AF81406232DB390261EFCE

Uniqueness

Uniqueness Score: -1.00%

Function 004258D4 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00425958
__alloca_probe_16.LIBCMT ref: 00425A1E
__freea.LIBCMT ref: 00425A8A

Part of subcall function 0041EA8A: RtlAllocateHeap.NTDLL(00000000,?,?,?,004191D3,?,?,?,?,?,004020F3,?,?), ref: 0041EABC

__freea.LIBCMT ref: 00425A93
__freea.LIBCMT ref: 00425AB6

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: c74094a0c6d5729c86e1c932978b4c2ceda6b25e6d516f0e0492038c5d5f24b8
Instruction ID: 7e0d7c363e2f027523b7077ca53f82abc72318da18e9cc0c3b19bc4bba63112a
Opcode Fuzzy Hash: c74094a0c6d5729c86e1c932978b4c2ceda6b25e6d516f0e0492038c5d5f24b8
Instruction Fuzzy Hash: 8351E672700626AFDB209F95EC86EBF37A9EF44764F95422AFC04D7240E778DC418698

Uniqueness

Uniqueness Score: -1.00%

Function 0041C10E Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,0041C040), ref: 0041C130
GetFileInformationByHandle.KERNEL32(?,?), ref: 0041C18A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0041C040,?,000000FF,00000000,00000000), ref: 0041C218
__dosmaperr.LIBCMT ref: 0041C21F
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 0041C25C

Part of subcall function 0041C484: __dosmaperr.LIBCMT ref: 0041C4B9

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: 8e7ecedbbb3726c11739f19b321c018a01a8de47d4bdd8436282d5c79af9c44f
Instruction ID: 0071a9752275d4edb8b9c21b1954eb469a97b67ce05b4548820d0adabff3a4d5
Opcode Fuzzy Hash: 8e7ecedbbb3726c11739f19b321c018a01a8de47d4bdd8436282d5c79af9c44f
Instruction Fuzzy Hash: B7413C75940204AFDB249FA5DC859EFBBF9EF89700B00452EF856D3610E7389885CB24

Uniqueness

Uniqueness Score: -1.00%

Function 021CC375 Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,021CC2A7), ref: 021CC397
GetFileInformationByHandle.KERNEL32(?,?), ref: 021CC3F1
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,021CC2A7,?,000000FF,00000000,00000000), ref: 021CC47F
__dosmaperr.LIBCMT ref: 021CC486
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 021CC4C3

Part of subcall function 021CC6EB: __dosmaperr.LIBCMT ref: 021CC720

Memory Dump Source

Source File: 00000000.00000002.310346113.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21b0000_7cduUYXDtl.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: 8e7ecedbbb3726c11739f19b321c018a01a8de47d4bdd8436282d5c79af9c44f
Instruction ID: 095a0639748e8f1af754a71bebad302c41c4302659f82edfba6c0374ac809f72
Opcode Fuzzy Hash: 8e7ecedbbb3726c11739f19b321c018a01a8de47d4bdd8436282d5c79af9c44f
Instruction Fuzzy Hash: B3414F79940204AFDB24EFB5DC449BFBBF9EF58700B24852EE85AD3610E7309845CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 004222EA Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00422302

Part of subcall function 0041E5A1: HeapFree.KERNEL32(00000000,00000000,?,0042237D,?,00000000,?,?,?,004223A4,?,00000007,?,?,004227A6,?), ref: 0041E5B7
Part of subcall function 0041E5A1: GetLastError.KERNEL32(?,?,0042237D,?,00000000,?,?,?,004223A4,?,00000007,?,?,004227A6,?,?), ref: 0041E5C9

_free.LIBCMT ref: 00422314
_free.LIBCMT ref: 00422326
_free.LIBCMT ref: 00422338
_free.LIBCMT ref: 0042234A

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a090e3dca2e19da394a01cead958df991e42452585b2f6658ee12e14c4d52992
Instruction ID: 8eed935d1f0a41e2b9dbe60b1656bd2ba3e28f3ae1fefd92f9cbf16fd4f54630
Opcode Fuzzy Hash: a090e3dca2e19da394a01cead958df991e42452585b2f6658ee12e14c4d52992
Instruction Fuzzy Hash: 04F04472501210B78520DBA6F6C2C4B73DAAB94355794180AF809D7641C77CFD81866C

Uniqueness

Uniqueness Score: -1.00%

Function 021BE207 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 494COMMON

Download Yara Rule

Strings

#, xrefs: 021BF9BB

Memory Dump Source

Source File: 00000000.00000002.310346113.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21b0000_7cduUYXDtl.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: #
API String ID: 3677997916-1885708031
Opcode ID: 4d26a9903dbf7e4ba4290750e16a9ab8299c95c43a50e3bd25ecedede5d2791d
Instruction ID: 413e0f059d992d56470604fc557ea71ffbc97bded595905dfeff37c00012e68e
Opcode Fuzzy Hash: 4d26a9903dbf7e4ba4290750e16a9ab8299c95c43a50e3bd25ecedede5d2791d
Instruction Fuzzy Hash: 4E12B170940288DFEB15DF68C958BDDBFB6AF55308F608198D804673C1D7B95A88CF92

Uniqueness

Uniqueness Score: -1.00%

Function 004209B7 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00420B51

Strings

*?, xrefs: 004209FA

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 4349432449d004c56f1fbb459abf86acb5202655a551f523de74eb3488688e5f
Instruction ID: 7415b14c5d0124b7c9719d17695bca9e12f23279d28e73ebbb8fdbf8e8460f59
Opcode Fuzzy Hash: 4349432449d004c56f1fbb459abf86acb5202655a551f523de74eb3488688e5f
Instruction Fuzzy Hash: 5661A1B5E002299FCB14CFA9D8815EEFBF5EF48314B54816AE805F7301E735AE418B94

Uniqueness

Uniqueness Score: -1.00%

Function 021CD0EF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\7cduUYXDtl.exe, xrefs: 021CD132, 021CD139, 021CD16F
X3Z, xrefs: 021CD140

Memory Dump Source

Source File: 00000000.00000002.310346113.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21b0000_7cduUYXDtl.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\7cduUYXDtl.exe$X3Z
API String ID: 0-1489364995
Opcode ID: 31fa4e4f4f0bc981144b5b3ffc5fea1ddf45f4662b4ea0433f5b95f05539bbed
Instruction ID: d066e180b9c7d1272e7bf77fa423bf521fbca1e855100b1807d671715baaae7d
Opcode Fuzzy Hash: 31fa4e4f4f0bc981144b5b3ffc5fea1ddf45f4662b4ea0433f5b95f05539bbed
Instruction Fuzzy Hash: 6E417379E80214AFDB15EF99EC84AAEBBF9EF99310B24407EE40597350D7719A40CB50

Uniqueness

Uniqueness Score: -1.00%

Function 021CA144 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 021CA169
CatchIt.LIBVCRUNTIME ref: 021CA24F

Strings

RCC, xrefs: 021CA183
MOC, xrefs: 021CA17B

Memory Dump Source

Source File: 00000000.00000002.310346113.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21b0000_7cduUYXDtl.jbxd

Yara matches

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 56cf5a80f9e67a63b3ea8228320d3624bd09d448c8f94bbe6aa890cfa768ed17
Instruction ID: 3f610f626612548ad6029732c0adcadef81e1dab14aabb72e33c5a240d1f71fc
Opcode Fuzzy Hash: 56cf5a80f9e67a63b3ea8228320d3624bd09d448c8f94bbe6aa890cfa768ed17
Instruction Fuzzy Hash: 7F41677994021DEFCF16CF98CD81AAEBBB6BF58304F248199F904A7264D3369960DF50

Uniqueness

Uniqueness Score: -1.00%

Function 004198D0 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00419997
___AdjustPointer.LIBCMT ref: 004199BA
___AdjustPointer.LIBCMT ref: 00419A56

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 7e8d2a906245dc524fe8c50e746b229fe3151c293ccc1eab8f3b2c5d31764d92
Instruction ID: a8cd01a110c9a5ba9b93cdf8b6ca506de852c713b8af7688bfec1274bd28d331
Opcode Fuzzy Hash: 7e8d2a906245dc524fe8c50e746b229fe3151c293ccc1eab8f3b2c5d31764d92
Instruction Fuzzy Hash: 3251D0B2601286AFDB298F15D861BEA77A4EF04314F24012FE84646391E739ECC1C799

Uniqueness

Uniqueness Score: -1.00%

Function 021B5667 Relevance: 6.2, APIs: 4, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,00439008,00000000), ref: 021B56E0
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 021B5747
GetProcAddress.KERNEL32(00000000), ref: 021B574E

Memory Dump Source

Source File: 00000000.00000002.310346113.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21b0000_7cduUYXDtl.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcVersion
String ID:
API String ID: 3310240892-0
Opcode ID: ddc787008df3d19dcf6ff3ff6324906e599249e81a3a5c2a1838fed2653284d0
Instruction ID: 78b22c3cffd2a0a7609933017eecf9e54febb24cb3eb61e68da7be5976e7784a
Opcode Fuzzy Hash: ddc787008df3d19dcf6ff3ff6324906e599249e81a3a5c2a1838fed2653284d0
Instruction Fuzzy Hash: 8B514571E40208AFDB25DB28DD897DDBB76EF45310FD042B8E804A7380EB358A848F91

Uniqueness

Uniqueness Score: -1.00%

Function 00425F0E Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00425FDE
_free.LIBCMT ref: 00426007
SetEndOfFile.KERNEL32(00000000,0042354B,00000000,?,?,?,?,?,?,?,?,0042354B,?,00000000), ref: 00426039
GetLastError.KERNEL32(?,?,?,?,?,?,?,0042354B,?,00000000,?,?,?,?,?), ref: 00426055

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 005ab2c57f032726cdaaa7f9df82d6b6984aac1401b59b4031c376f8f621a61a
Instruction ID: 61c1fed18fa2e053e229d2c366b1320fca6b3d495f3fb51fd3c042a4ee27fee9
Opcode Fuzzy Hash: 005ab2c57f032726cdaaa7f9df82d6b6984aac1401b59b4031c376f8f621a61a
Instruction Fuzzy Hash: 6C413E72B006115BDB11ABB5ED41B8E37B6AF44364F560017F424E72D2EB7CC840576D

Uniqueness

Uniqueness Score: -1.00%

Function 021D6175 Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 021D6245
_free.LIBCMT ref: 021D626E
SetEndOfFile.KERNEL32(00000000,021D37B2,00000000,021CE6A5,?,?,?,?,?,?,?,021D37B2,021CE6A5,00000000), ref: 021D62A0
GetLastError.KERNEL32(?,?,?,?,?,?,?,021D37B2,021CE6A5,00000000,?,?,?,?,00000000), ref: 021D62BC

Memory Dump Source

Source File: 00000000.00000002.310346113.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21b0000_7cduUYXDtl.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 005ab2c57f032726cdaaa7f9df82d6b6984aac1401b59b4031c376f8f621a61a
Instruction ID: 8047bc7e0309d8f3f9837bddf6b3af7b19cca839719b90d4772e396396748b96
Opcode Fuzzy Hash: 005ab2c57f032726cdaaa7f9df82d6b6984aac1401b59b4031c376f8f621a61a
Instruction Fuzzy Hash: B441D3769C0284EFDF25AFB8EC01B9E377EEF54360F250615E418A7290EB34D8448B61

Uniqueness

Uniqueness Score: -1.00%

Function 004208E8 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0041BD6F: _free.LIBCMT ref: 0041BD7D

Part of subcall function 004218BF: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,00425A80,?,00000000,00000000), ref: 00421961

GetLastError.KERNEL32 ref: 00420950
__dosmaperr.LIBCMT ref: 00420957
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 00420996
__dosmaperr.LIBCMT ref: 0042099D

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 2cc476a48764411ac7d7f7841f806bb526956e32d48153aac2d156f6a7af72d6
Instruction ID: 91911ec1de34df9e01eb008ea9a24e12f878ac442d2ad626700c96a69c790fc9
Opcode Fuzzy Hash: 2cc476a48764411ac7d7f7841f806bb526956e32d48153aac2d156f6a7af72d6
Instruction Fuzzy Hash: 2721F0B1700225AFA710AF62ACC196B77EDEF00374790851AF86697253D738DCC08B94

Uniqueness

Uniqueness Score: -1.00%

Function 021CF3B3 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.310346113.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21b0000_7cduUYXDtl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d346eea9aafd959945e16ecfc9ebbe047e966c499b5e8e0d3b3e0bbc48b51e8c
Instruction ID: 98b015018ef2d5211964b89e630427141422cad3b6395727733d8247dfcac183
Opcode Fuzzy Hash: d346eea9aafd959945e16ecfc9ebbe047e966c499b5e8e0d3b3e0bbc48b51e8c
Instruction Fuzzy Hash: 8921F339B81224EBC7319B249C80B2A376AAB21B74F75013BED15A7A91D730EC06C5E4

Uniqueness

Uniqueness Score: -1.00%

Function 0041EE92 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,0041BCED,00000000,?,?,?,0041BE86,?), ref: 0041EE97
_free.LIBCMT ref: 0041EEF4
_free.LIBCMT ref: 0041EF2A
SetLastError.KERNEL32(00000000,00000008,000000FF,?,?,?,0041BE86,?), ref: 0041EF35

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 120db594496689011f9c139fa4ddd92dcfd12b70a1cc6502b103967e01bc71cb
Instruction ID: 26790fddcd24ef136aadc0cc0bf27d5f777129a8301660e6568487d79e7ca8b5
Opcode Fuzzy Hash: 120db594496689011f9c139fa4ddd92dcfd12b70a1cc6502b103967e01bc71cb
Instruction Fuzzy Hash: 2411CA3A6002017AD61427B79CC59EB256997C1779B25013BFD39832D2FE6D8CDB811D

Uniqueness

Uniqueness Score: -1.00%

Function 021CF0F9 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,021CBF54,00000000,?,?,?,021CC0ED,?), ref: 021CF0FE
_free.LIBCMT ref: 021CF15B
_free.LIBCMT ref: 021CF191
SetLastError.KERNEL32(00000000,004390F8,000000FF,?,?,?,021CC0ED,?), ref: 021CF19C

Memory Dump Source

Source File: 00000000.00000002.310346113.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21b0000_7cduUYXDtl.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 120db594496689011f9c139fa4ddd92dcfd12b70a1cc6502b103967e01bc71cb
Instruction ID: 0754d6b0aad111c6a28f68d6f3c076544a6ebe3be3c0e791ccb81c147eaa0f99
Opcode Fuzzy Hash: 120db594496689011f9c139fa4ddd92dcfd12b70a1cc6502b103967e01bc71cb
Instruction Fuzzy Hash: 5A11367E2C01016EC6143BB4DCC496B266BCBE0374B32013FF52582AE0EF618D174590

Uniqueness

Uniqueness Score: -1.00%

Function 0041EFE9 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0041C755,0041EACD,?,?,004191D3,?,?,?,?,?,004020F3,?,?), ref: 0041EFEE
_free.LIBCMT ref: 0041F04B
_free.LIBCMT ref: 0041F081
SetLastError.KERNEL32(00000000,00000008,000000FF,?,?,004191D3,?,?,?,?,?,004020F3,?,?), ref: 0041F08C

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 048b735e334959feaa5e4ce77df0ba5808e7239d9d4b1868442944ab324b2044
Instruction ID: d1a755533480a66cbcbdd6da6f61a8fcfdc6096e1f08231a3cc2ec091d2cf52b
Opcode Fuzzy Hash: 048b735e334959feaa5e4ce77df0ba5808e7239d9d4b1868442944ab324b2044
Instruction Fuzzy Hash: FB114C322045016AC7102B76ACC1DEB2969DBC8778765023BF92A822E3EF6CCCDF511C

Uniqueness

Uniqueness Score: -1.00%

Function 021CF250 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,021CC9BC,021CED34,?,?,021C943A,?,?,?,?,?,021B235A,?,?), ref: 021CF255
_free.LIBCMT ref: 021CF2B2
_free.LIBCMT ref: 021CF2E8
SetLastError.KERNEL32(00000000,004390F8,000000FF,?,?,021C943A,?,?,?,?,?,021B235A,?,?), ref: 021CF2F3

Memory Dump Source

Source File: 00000000.00000002.310346113.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21b0000_7cduUYXDtl.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 048b735e334959feaa5e4ce77df0ba5808e7239d9d4b1868442944ab324b2044
Instruction ID: 58232ca8460e935bdd390e6a6b6f2d1617488b520e410866b9390cef6b41bc83
Opcode Fuzzy Hash: 048b735e334959feaa5e4ce77df0ba5808e7239d9d4b1868442944ab324b2044
Instruction Fuzzy Hash: CE11293E2C42116EDA1527789CC0DAA216BD7E0375B72023FF926829E4EF61CC578594

Uniqueness

Uniqueness Score: -1.00%

Function 0041F7CB Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,0041F930,00000000,?,00424658,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 0041F7E1
GetLastError.KERNEL32(?,00424658,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,0041F930,00000000,00000104,?), ref: 0041F7EB
__dosmaperr.LIBCMT ref: 0041F7F2

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 05d28394caa5e79c84551c055246600de674f2baba94b68408dd47ae0dfcca9d
Instruction ID: 3e1febbc0a8defaca1089d50814ae8bcfad4f789bcb8220d5dd2739c2ed7ebaf
Opcode Fuzzy Hash: 05d28394caa5e79c84551c055246600de674f2baba94b68408dd47ae0dfcca9d
Instruction Fuzzy Hash: 1DF06D36600115BB8B202FA2DD08C9BBFA9FF443A03444136F52DC7561DB35E8A6CBE8

Uniqueness

Uniqueness Score: -1.00%

Function 0041F834 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,0041F930,00000000,?,004245E3,00000000,00000000,0041F930,?,?,00000000,00000000,00000001), ref: 0041F84A
GetLastError.KERNEL32(?,004245E3,00000000,00000000,0041F930,?,?,00000000,00000000,00000001,00000000,00000000,?,0041F930,00000000,00000104), ref: 0041F854
__dosmaperr.LIBCMT ref: 0041F85B

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: e95b58acd20ff03b7de0604d3f95648f78153c488b68a8cfe7999cd59df17e1a
Instruction ID: 5356ccb821a571137923583999cca56af5607f561d8780d9d137012589ba4a16
Opcode Fuzzy Hash: e95b58acd20ff03b7de0604d3f95648f78153c488b68a8cfe7999cd59df17e1a
Instruction Fuzzy Hash: FBF01231600115BB8B207BA6DC0499BBFA9FF443A03404536F52DC6521C735E8A6DBD4

Uniqueness

Uniqueness Score: -1.00%

Function 004272CF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00405880,00000000,00437A28,00000000,00405880,?,004269E7,00405880,00000001,00405880,00405880,?,00423E1B,00000000,?,00405880), ref: 004272E6
GetLastError.KERNEL32(?,004269E7,00405880,00000001,00405880,00405880,?,00423E1B,00000000,?,00405880,00000000,00405880,?,0042436F,00405880), ref: 004272F2

Part of subcall function 004272B8: CloseHandle.KERNEL32(FFFFFFFE,00427302,?,004269E7,00405880,00000001,00405880,00405880,?,00423E1B,00000000,?,00405880,00000000,00405880), ref: 004272C8

___initconout.LIBCMT ref: 00427302

Part of subcall function 0042727A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,004272A9,004269D4,00405880,?,00423E1B,00000000,?,00405880,00000000), ref: 0042728D

WriteConsoleW.KERNEL32(00405880,00000000,00437A28,00000000,?,004269E7,00405880,00000001,00405880,00405880,?,00423E1B,00000000,?,00405880,00000000), ref: 00427317

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 654839e4b531a485c8561e35f9c6b1b80fe1c4fa203d6a6e5454fb2027dc39d5
Instruction ID: 5b8baa1da4bb66d128bbbdf819d740daca6d0282673a7c9b135cb97f91750bdc
Opcode Fuzzy Hash: 654839e4b531a485c8561e35f9c6b1b80fe1c4fa203d6a6e5454fb2027dc39d5
Instruction Fuzzy Hash: 46F01C36201129FBCF221F95EC04A8A3F66FF093A1B814075FE1C86231D6328820EB98

Uniqueness

Uniqueness Score: -1.00%

Function 004167E0 Relevance: 6.0, APIs: 4, Instructions: 27threadsleepCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 004167F6
CreateThread.KERNEL32 ref: 00416807
CreateThread.KERNEL32 ref: 00416818
Sleep.KERNEL32(00007530,?,00416873), ref: 00416825

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: CreateThread$Sleep
String ID:
API String ID: 422425972-0
Opcode ID: c7ec29c90368d79a70c95a5ee9845132da8938ab2cedaa7c12f416f09ab0d9a8
Instruction ID: 3e58bb4c01d1f945cb402fb00719d76fe511b7683de936d62f19d1048555ce50
Opcode Fuzzy Hash: c7ec29c90368d79a70c95a5ee9845132da8938ab2cedaa7c12f416f09ab0d9a8
Instruction Fuzzy Hash: 69E09231BE8334B6F47126A45C03F891E545B08F95FB20023B70CBE4D084C87485CAEE

Uniqueness

Uniqueness Score: -1.00%

Function 004122F0 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 374COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00412FEF

Part of subcall function 00416F50: Concurrency::cancel_current_task.LIBCPMT ref: 00417083

Strings

stoi argument out of range, xrefs: 00412FF9
invalid stoi argument, xrefs: 00412FEA

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: Concurrency::cancel_current_taskXinvalid_argumentstd::_
String ID: invalid stoi argument$stoi argument out of range
API String ID: 3646673767-1606216832
Opcode ID: 050e6ca51479918143ee8ec0ef84eb66a48c69742fddbd145cb43d031d79236e
Instruction ID: 6d18bec53ddcbea06decae191a6eae5fb5e1180c669e5708db714ed38e612d95
Opcode Fuzzy Hash: 050e6ca51479918143ee8ec0ef84eb66a48c69742fddbd145cb43d031d79236e
Instruction Fuzzy Hash: 60E1D171A001189BEF28DF28CE857DDBB72EB46304F50819EE419972C1DB799AD1CF98

Uniqueness

Uniqueness Score: -1.00%

Function 021C9737 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 021C9776
__IsNonwritableInCurrentImage.LIBCMT ref: 021C982A

Strings

csm, xrefs: 021C9814

Memory Dump Source

Source File: 00000000.00000002.310346113.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21b0000_7cduUYXDtl.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 170db4f13a52bbc04fbb15fe7ab42c90d24a7c19ae8ceb0e3c19913b98646896
Instruction ID: b038579885accfb925aca2e9edefcec9f5b17973998a76435da9b59f063da29e
Opcode Fuzzy Hash: 170db4f13a52bbc04fbb15fe7ab42c90d24a7c19ae8ceb0e3c19913b98646896
Instruction Fuzzy Hash: F441D638A40258AFCF10DF68C884AAEBBB5FF54318F248479E8145B391D731D915CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00419EDD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00419F02

Strings

RCC, xrefs: 00419F1C
MOC, xrefs: 00419F14

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 56cf5a80f9e67a63b3ea8228320d3624bd09d448c8f94bbe6aa890cfa768ed17
Instruction ID: ef4240616421f5d170a5d1c4fd7b0d446090a164c11462a96303fe54a6744129
Opcode Fuzzy Hash: 56cf5a80f9e67a63b3ea8228320d3624bd09d448c8f94bbe6aa890cfa768ed17
Instruction Fuzzy Hash: 5C414872900209EFCF16DF98C981AEEBBB5FF48304F18819AF904A7251D3399DA1DB55

Uniqueness

Uniqueness Score: -1.00%

Function 00421C65 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00421CC7
_free.LIBCMT ref: 00421CF5

Part of subcall function 0041DD06: IsProcessorFeaturePresent.KERNEL32(00000017,0041EF4E,?,?,?,0041BE86,?), ref: 0041DD22

Part of subcall function 0041CC59: IsProcessorFeaturePresent.KERNEL32(00000017,0041CC2B,?,?,?,?,?,00000016,?,0041CC38,00000000,00000000,00000000,00000000,00000000,0041DD77), ref: 0041CC5B
Part of subcall function 0041CC59: GetCurrentProcess.KERNEL32(C0000417), ref: 0041CC7E
Part of subcall function 0041CC59: TerminateProcess.KERNEL32(00000000), ref: 0041CC85

Strings

HZ, xrefs: 00421D15, 00421D29

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: FeaturePresentProcessProcessor_free$CurrentTerminate
String ID: HZ
API String ID: 1729132349-879387849
Opcode ID: 0f36dddd8b4ee7bd80d979806f6699cf8434447909bf8933e8c9f37e99733de7
Instruction ID: fb96563ff89630bf3c4fa0cd8806ccd045e69199b4ab4989cf5e03b4162a4e50
Opcode Fuzzy Hash: 0f36dddd8b4ee7bd80d979806f6699cf8434447909bf8933e8c9f37e99733de7
Instruction Fuzzy Hash: 55216779B44211ABEB159FA6F884BA733A9DFA4314F64007FE804C7262EB79D841C748

Uniqueness

Uniqueness Score: -1.00%

Function 00412CFF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00412D18

Strings

5120, xrefs: 00412D5F
., xrefs: 00412DCB

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: FileModuleName
String ID: .$5120
API String ID: 514040917-2446372808
Opcode ID: f99830547a012116d5b52b04e72eafd6a293cbb33d9ac81bb1d8b6fc8795619a
Instruction ID: 9696d8c15566c1d42fadb68592e21f39738dfdc301de5d2260ec8dd83da14f2d
Opcode Fuzzy Hash: f99830547a012116d5b52b04e72eafd6a293cbb33d9ac81bb1d8b6fc8795619a
Instruction Fuzzy Hash: D421E2B09002489BDB14EF69C90A7DD7FB49F06348F5001CEE44567282D7B99A498BE7

Uniqueness

Uniqueness Score: -1.00%

Function 00423927 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041FDF2: EnterCriticalSection.KERNEL32(00405880,?,00424223,00405880,00437D48,00000010,0041EA11,00000000,C032C301,00000000,00000000,00405880,?,0041BB1A,00405880,00000000), ref: 0041FE0D

FlushFileBuffers.KERNEL32(00000000,00437D28,0000000C,00423A2E,nA,?,00000001,?,0041E96E,?), ref: 00423970
GetLastError.KERNEL32 ref: 00423981

Strings

nA, xrefs: 004239A8

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: BuffersCriticalEnterErrorFileFlushLastSection
String ID: nA
API String ID: 4109680722-4035868545
Opcode ID: f003fc8eaf19488ae7f9339aa40c70496bc05c9f4a2d22a8ae3e610d030b7c35
Instruction ID: 0418fce989e2f534913a4f38d2ce8aa3e5464a19317c2ea272403c313fbf0c0e
Opcode Fuzzy Hash: f003fc8eaf19488ae7f9339aa40c70496bc05c9f4a2d22a8ae3e610d030b7c35
Instruction Fuzzy Hash: 45018076B002108FC714AF69E90569D7BB5AF49724F50412FF4219B3D2DBBC9982CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041DB08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 0041DB08
GetCommandLineW.KERNEL32 ref: 0041DB13

Strings

X3Z, xrefs: 0041DB0E

Memory Dump Source

Source File: 00000000.00000002.310039188.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.310091436.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7cduUYXDtl.jbxd

Similarity

API ID: CommandLine
String ID: X3Z
API String ID: 3253501508-3795549120
Opcode ID: 763540b409d2f59638321d6ad6c58e5475a13b84e75f291d525d9f5e2255dcd8
Instruction ID: 75fcc70df7de8c95f4d97ac528dce34a6a2d18f8ef6a6ec30f935ab3d3f366a5
Opcode Fuzzy Hash: 763540b409d2f59638321d6ad6c58e5475a13b84e75f291d525d9f5e2255dcd8
Instruction Fuzzy Hash: CDB09278940200CFC7108F78F80C0253BB0B7086123C07076D841C2330EA35082ACF0A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rovwer.exePID: 4332, Parent PID: 1084COMMON

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	14.8%
Signature Coverage:	0.5%
Total number of Nodes:	1322
Total number of Limit Nodes:	11

Executed Functions

Function 0041B901 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,0041B900,0041BE86,?,NA,0041BE86,0041EF4E), ref: 0041B923
TerminateProcess.KERNEL32(00000000,?,0041B900,0041BE86,?,NA,0041BE86,0041EF4E), ref: 0041B92A
ExitProcess.KERNEL32 ref: 0041B93C

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 3d3398b3f9dcf73c51e1cd00535af5d0e13f2263922661259b1695b405c8b0d4
Instruction ID: c3524ad3d233ec0a3a19b1bf7aedcb75de5af13a6c7a41cb1465cf438659ca8f
Opcode Fuzzy Hash: 3d3398b3f9dcf73c51e1cd00535af5d0e13f2263922661259b1695b405c8b0d4
Instruction Fuzzy Hash: 63E0B671120208EFCB216F65DD49AA97B79FB44751BC44439FA0586231CB39EE93CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0087F23E Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0087F266
Module32First.KERNEL32(00000000,00000224), ref: 0087F286

Memory Dump Source

Source File: 00000005.00000002.347151025.000000000087E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0087E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_87e000_rovwer.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 863f65daa9c50eed53724a0a9ada00a027b2a12474693e89094b812ac830c07f
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: B5F0F6361007107BDB203BFA988CB6E76E8FF49324F104538E74AD24C2CB70EC054A61

Uniqueness

Uniqueness Score: -1.00%

Function 00408650 Relevance: 4.9, APIs: 3, Instructions: 374
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(00000000,00000000,?,0043A194,34AAABE9,?,00000000,00000000), ref: 004086B1
GetLastError.KERNEL32(?,00000000,00000000), ref: 004086B7

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: a5b5c924cf0598033fc7552755438c6b161d435a7d09cfac228ba958160edf38
Instruction ID: d5025c2257f1853fae8f1be1934c88d0cd5ba35f682ee7a5a0e711edb3be859e
Opcode Fuzzy Hash: a5b5c924cf0598033fc7552755438c6b161d435a7d09cfac228ba958160edf38
Instruction Fuzzy Hash: 57D15C71A001089BEB18DB28CE85BDDB772EF85314F60817EE445B73D6DF395A808B59

Uniqueness

Uniqueness Score: -1.00%

Function 0041D1BB Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 0041D203

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 9f5dec638c6018a6b24b976b0791b773a56ee0672529c52ab4d44372aafa3d49
Instruction ID: f1d333090dd57bfd17dfe39ecb9b07313f9b1ca465b706eabb36e918cd1afe6e
Opcode Fuzzy Hash: 9f5dec638c6018a6b24b976b0791b773a56ee0672529c52ab4d44372aafa3d49
Instruction Fuzzy Hash: 4FE0E5B6E0242022E211623F7C46AEB11856BD133AB15022FF860861E0DF7C88C2D19E

Uniqueness

Uniqueness Score: -1.00%

Function 00408770 Relevance: 1.7, APIs: 1, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00408770: GetModuleFileNameA.KERNEL32(00000000,?,00000104,34AAABE9), ref: 00406BFF

Part of subcall function 00406590: GetModuleFileNameA.KERNEL32(00000000,?,00000104,34AAABE9,?,00000000), ref: 004065F3

SetCurrentDirectoryA.KERNEL32(00000000,34AAABE9,00000000), ref: 004087BC

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: FileModuleName$CurrentDirectory
String ID:
API String ID: 1135421992-0
Opcode ID: c0393972aab4d93959729be5652f9478907cec9a3f92d5172277890f364fd88e
Instruction ID: d0dae173410c9e4e1febe3177f2c9113cc4b317fee0fa56548834116e9d8ebca
Opcode Fuzzy Hash: c0393972aab4d93959729be5652f9478907cec9a3f92d5172277890f364fd88e
Instruction Fuzzy Hash: 4B51FA70E002489BEF14EB64CA45BDDBB72AF42308F6041AED445773C7DB781A84CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00417A50 Relevance: 1.6, APIs: 1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00417B8F

Part of subcall function 00402180: ___std_exception_copy.LIBVCRUNTIME ref: 004021BE

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: Concurrency::cancel_current_task___std_exception_copy
String ID:
API String ID: 1979911387-0
Opcode ID: d28470824307c46c043b17cc731677d80b73be28b83e5386658e58e37f45c324
Instruction ID: 17865e07c0a9020476bb62f3ecb7ae26e4e2800d30adc2ccf051e38fdb3837cc
Opcode Fuzzy Hash: d28470824307c46c043b17cc731677d80b73be28b83e5386658e58e37f45c324
Instruction Fuzzy Hash: CD414772A0810A9BCB14DF288C819EFB3B5FF84358714067AD819DB341E734EE9583D9

Uniqueness

Uniqueness Score: -1.00%

Function 0041835E Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004021BE

Part of subcall function 004193E4: RaiseException.KERNEL32(E06D7363,00000001,00000003,0040219C,?,?,?,0040219C,?,00437E4C), ref: 00419444

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID:
API String ID: 3109751735-0
Opcode ID: 79f28c06042652cc4a4b4e37ebf95145dffe76a591269d0a023a1b3527f7ecb0
Instruction ID: 0754849f2873f9ee99eecf20cf2606fb6430f2f66f9579a4d74c0798b0fd6e96
Opcode Fuzzy Hash: 79f28c06042652cc4a4b4e37ebf95145dffe76a591269d0a023a1b3527f7ecb0
Instruction Fuzzy Hash: 09012B3590020D77C714BAA5EC469CA73AC9E04714B60453BF928A7191FB78E9C587DD

Uniqueness

Uniqueness Score: -1.00%

Function 0041FCA4 Relevance: 1.6, APIs: 1, Instructions: 52
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00420873: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0041F034,00000001,00000364,00000008,000000FF,?,?,004191D3,?), ref: 004208B4

_free.LIBCMT ref: 0041FD13

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: bbfaf170cd2aa4a5dd4654b786cba334a1d7a93fa1ef5963fa5f0812df2330b2
Instruction ID: 70b6eeed5610955833eca53ebfbf82cf5bb37bdb6f1881a91f0ece62663c8b3f
Opcode Fuzzy Hash: bbfaf170cd2aa4a5dd4654b786cba334a1d7a93fa1ef5963fa5f0812df2330b2
Instruction Fuzzy Hash: 640149B26043566BC3209F99D881ADAFB98FB443B4F10062EE545A76C0E374AC56C7E8

Uniqueness

Uniqueness Score: -1.00%

Function 00420873 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0041F034,00000001,00000364,00000008,000000FF,?,?,004191D3,?), ref: 004208B4

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b74571d69d9b0232edf4526da73c509a374cb4a9f19198f923c60397a3458b71
Instruction ID: fd7077de4c568d6a2e66846734c52a563ccaa344bff8033cadba6e7d35bed193
Opcode Fuzzy Hash: b74571d69d9b0232edf4526da73c509a374cb4a9f19198f923c60397a3458b71
Instruction Fuzzy Hash: A8F0B432701235669B257A23AC05B5B37E9AF417A0B544137E818A6293DB68E80586EC

Uniqueness

Uniqueness Score: -1.00%

Function 00416830 Relevance: 1.5, APIs: 1, Instructions: 36
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040CBD0: GetTempPathA.KERNEL32(00000104,?), ref: 0040B2FE

Part of subcall function 0040CBD0: GetModuleFileNameA.KERNEL32(00000000,?,00000104,34AAABE9), ref: 0040A7BC

Part of subcall function 00406510: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00406540

Part of subcall function 0040CBD0: GetUserNameA.ADVAPI32(?,?), ref: 0040B96E

Part of subcall function 004138B0: IsUserAnAdmin.SHELL32 ref: 0041390D
Part of subcall function 004138B0: GetUserNameA.ADVAPI32(?,?), ref: 004139B7
Part of subcall function 004138B0: GetComputerNameExW.KERNEL32(00000002,?,?,?,?), ref: 00413A20

Part of subcall function 004167E0: CreateThread.KERNEL32 ref: 004167F6
Part of subcall function 004167E0: CreateThread.KERNEL32 ref: 00416807
Part of subcall function 004167E0: CreateThread.KERNEL32 ref: 00416818
Part of subcall function 004167E0: Sleep.KERNEL32(00007530,?,00416873), ref: 00416825

InternetCloseHandle.WININET(00000000), ref: 00416887

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: Name$CreateThreadUser$FileModule$AdminCloseComputerHandleInternetPathSleepTemp
String ID:
API String ID: 1411138196-0
Opcode ID: 681845bb7bdad3a9b280c05efa4f412a3339f2d7827d3117315032cc1d5ff116
Instruction ID: fcb51b4180ac2c01cd311fc2696d032aed602c74c46a29392a881be8b31f0bff
Opcode Fuzzy Hash: 681845bb7bdad3a9b280c05efa4f412a3339f2d7827d3117315032cc1d5ff116
Instruction Fuzzy Hash: 21E08671A0050407DA043BBA5D0B64E31184F8134CF94027FB815665D7EE6DD56441FF

Uniqueness

Uniqueness Score: -1.00%

Function 0041EA8A Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,004191D3,?,?,?,?,?,004020F3,?,?), ref: 0041EABC

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: dfa22ebf96d117e5e2d1e15a0c463ff833afb46ba7fb8ad48bf3f6a11dcdaed7
Instruction ID: 5e5b785a8da04b63c94067ca99906f02eb36a9a31bcd46b4234264a7978573d4
Opcode Fuzzy Hash: dfa22ebf96d117e5e2d1e15a0c463ff833afb46ba7fb8ad48bf3f6a11dcdaed7
Instruction Fuzzy Hash: A5E0E53954012266E62126634C007DB7A48BF813F0F050037EC18962C0DB98DCC182ED

Uniqueness

Uniqueness Score: -1.00%

Function 0087EEFD Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0087EF4E

Memory Dump Source

Source File: 00000005.00000002.347151025.000000000087E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0087E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_87e000_rovwer.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 9c2cd20f36a150e4d09d273ac4be7d2c6d664076a40042a0582e12adfaaea19f
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 35112B79A00208EFDB01DF98C985E98BBF5EF08350F1580A4F9489B362D771EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00403F40 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 162injectionthreadmemoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00403F66
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00403FCB
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00403FE4
GetThreadContext.KERNEL32(?,00000000), ref: 00403FFF
ReadProcessMemory.KERNEL32(?, ,?,00000004,00000000), ref: 00404023
GetModuleHandleA.KERNEL32(ntdll.dll,NtUnmapViewOfSection), ref: 0040403E
GetProcAddress.KERNEL32(00000000), ref: 00404045
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 0040406D
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 0040408E
WriteProcessMemory.KERNEL32(?,?,?,?,00000000,?,?,00000000), ref: 004040D2
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,00000000), ref: 0040410E
SetThreadContext.KERNEL32(?,00000000,?,?,00000000), ref: 0040412A
ResumeThread.KERNEL32(?,?,?,00000000), ref: 00404136
VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000), ref: 00404144
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00404165

Strings

, xrefs: 00404018
NtUnmapViewOfSection, xrefs: 00404034
ntdll.dll, xrefs: 00404039

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: Process$MemoryVirtual$ThreadWrite$AllocContextFreeModule$AddressCreateFileHandleNameProcReadResume
String ID: $NtUnmapViewOfSection$ntdll.dll
API String ID: 4033543172-1522589568
Opcode ID: 2fc5be1b3ec4d92441bc9103c4f92097ff01d4c177745f7de35fcca25cf32f0a
Instruction ID: 7185e54e9f5f5e6bc342fc5ffd2bfcf32a837d4cfdcfbf42461452ed81247528
Opcode Fuzzy Hash: 2fc5be1b3ec4d92441bc9103c4f92097ff01d4c177745f7de35fcca25cf32f0a
Instruction Fuzzy Hash: 66518971600218EBDB209F54DC49FEAB7B8FF48701F9040B6F708AA291D7B1A995CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004037D0 Relevance: 27.2, APIs: 18, Instructions: 210memoryCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 00403822
GetProcessHeap.KERNEL32(00000008,?), ref: 00403837
HeapAlloc.KERNEL32(00000000), ref: 0040383A
GetUserNameW.ADVAPI32(00000000,?), ref: 00403848
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 0040386B
GetProcessHeap.KERNEL32(00000008,?), ref: 00403876
HeapAlloc.KERNEL32(00000000), ref: 00403879
GetProcessHeap.KERNEL32(00000008,?), ref: 00403889
HeapAlloc.KERNEL32(00000000), ref: 0040388C
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 004038B6
ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 004038C9
GetProcessHeap.KERNEL32(00000000,?), ref: 004039C5
HeapFree.KERNEL32(00000000), ref: 004039CE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004039D3
HeapFree.KERNEL32(00000000), ref: 004039D6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004039DD
HeapFree.KERNEL32(00000000), ref: 004039E0
LocalFree.KERNEL32(00000000), ref: 004039E5

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: Heap$Process$FreeName$Alloc$AccountLookupUser$ConvertLocalString
String ID:
API String ID: 3326663573-0
Opcode ID: 78a4ed75098941435d79c9e4be2ef9b8bcea189319cacdc9b38411f4183bede5
Instruction ID: 167f534f4a5bc3f8c65bdd595c5ec8e1d54d44385eb9c59962b1969d814595bf
Opcode Fuzzy Hash: 78a4ed75098941435d79c9e4be2ef9b8bcea189319cacdc9b38411f4183bede5
Instruction Fuzzy Hash: EA716DB1E00209ABDB14DFA5DC85BEFBBBCEB48300F40453AE905A7281DB749905CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0042260F Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00422653

Part of subcall function 004221EC: _free.LIBCMT ref: 00422209
Part of subcall function 004221EC: _free.LIBCMT ref: 0042221B
Part of subcall function 004221EC: _free.LIBCMT ref: 0042222D
Part of subcall function 004221EC: _free.LIBCMT ref: 0042223F
Part of subcall function 004221EC: _free.LIBCMT ref: 00422251
Part of subcall function 004221EC: _free.LIBCMT ref: 00422263
Part of subcall function 004221EC: _free.LIBCMT ref: 00422275
Part of subcall function 004221EC: _free.LIBCMT ref: 00422287
Part of subcall function 004221EC: _free.LIBCMT ref: 00422299
Part of subcall function 004221EC: _free.LIBCMT ref: 004222AB
Part of subcall function 004221EC: _free.LIBCMT ref: 004222BD
Part of subcall function 004221EC: _free.LIBCMT ref: 004222CF
Part of subcall function 004221EC: _free.LIBCMT ref: 004222E1

_free.LIBCMT ref: 00422648

Part of subcall function 0041E5A1: HeapFree.KERNEL32(00000000,00000000,?,0042237D,?,00000000,?,?,?,004223A4,?,00000007,?,?,004227A6,?), ref: 0041E5B7
Part of subcall function 0041E5A1: GetLastError.KERNEL32(?,?,0042237D,?,00000000,?,?,?,004223A4,?,00000007,?,?,004227A6,?,?), ref: 0041E5C9

_free.LIBCMT ref: 0042266A
_free.LIBCMT ref: 0042267F
_free.LIBCMT ref: 0042268A
_free.LIBCMT ref: 004226AC
_free.LIBCMT ref: 004226BF
_free.LIBCMT ref: 004226CD
_free.LIBCMT ref: 004226D8
_free.LIBCMT ref: 00422710
_free.LIBCMT ref: 00422717
_free.LIBCMT ref: 00422734
_free.LIBCMT ref: 0042274C

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 2ebc8ac26202a0620aa625b36a1d2a8fe7bc692bad1c871fd446d657effbc3a9
Instruction ID: 87a383156b0838ac626f9c2c6038cf6ce1f5ffd7cd3d592d57855f9c4539c293
Opcode Fuzzy Hash: 2ebc8ac26202a0620aa625b36a1d2a8fe7bc692bad1c871fd446d657effbc3a9
Instruction Fuzzy Hash: B6319272604211BFEB205A76EA45B9B73E5AF80358F50441FE849D7251DFBCED80DB18

Uniqueness

Uniqueness Score: -1.00%

Function 00419B27 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00419C22
type_info::operator==.LIBVCRUNTIME ref: 00419C49
___TypeMatch.LIBVCRUNTIME ref: 00419D55
IsInExceptionSpec.LIBVCRUNTIME ref: 00419E30
_UnwindNestedFrames.LIBCMT ref: 00419EB7
CallUnexpected.LIBVCRUNTIME ref: 00419ED2

Strings

csm, xrefs: 00419B62
csm, xrefs: 00419BCF
csm, xrefs: 00419C80

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 7c1fb931e7428280153d6c09b5a5c630754522480dfed903c9c8a59691bc5c1e
Instruction ID: d03aefa22aee8cf5aa416bea0a170c685dbf4c7cd79984a2e6415da9b3a38480
Opcode Fuzzy Hash: 7c1fb931e7428280153d6c09b5a5c630754522480dfed903c9c8a59691bc5c1e
Instruction Fuzzy Hash: 49C18871900209EFCF29DFA5D8A19EEBBB5BF04314F14405BE8516B242D339DE91CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00408B5C Relevance: 15.2, APIs: 10, Instructions: 219networkfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00408BAC
InternetOpenA.WININET(0043432B,00000000,00000000,00000000,00000000), ref: 00408BC2
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00408BE2
InternetReadFile.WININET(00000000,00000000,?,?), ref: 00408BF3
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00408C15
InternetReadFile.WININET(00000000,00000000,?,?), ref: 00408C20
CloseHandle.KERNEL32(?), ref: 00408C32
InternetCloseHandle.WININET(?), ref: 00408C41
InternetCloseHandle.WININET(00000000), ref: 00408C44
RemoveDirectoryA.KERNEL32(00000000,?,?,?), ref: 00408CFD

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: Internet$File$CloseHandle$OpenRead$CreateDirectoryRemoveWrite
String ID:
API String ID: 1496009958-0
Opcode ID: a03c8a6a5dc2d60af4fabd9a53e78b3c0acd28151ef74d758808e3d68e992827
Instruction ID: e39da941a42be4000a8416f9d2a6f8c848e32a180712f45a109694aa4e2734ce
Opcode Fuzzy Hash: a03c8a6a5dc2d60af4fabd9a53e78b3c0acd28151ef74d758808e3d68e992827
Instruction Fuzzy Hash: 6E71EF71600208ABEB14DF64DD85BEE7735EF44304F50423EF945AB2D1DB38A980CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0041ED7A Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041ED90

Part of subcall function 0041E5A1: HeapFree.KERNEL32(00000000,00000000,?,0042237D,?,00000000,?,?,?,004223A4,?,00000007,?,?,004227A6,?), ref: 0041E5B7
Part of subcall function 0041E5A1: GetLastError.KERNEL32(?,?,0042237D,?,00000000,?,?,?,004223A4,?,00000007,?,?,004227A6,?,?), ref: 0041E5C9

_free.LIBCMT ref: 0041ED9C
_free.LIBCMT ref: 0041EDA7
_free.LIBCMT ref: 0041EDB2
_free.LIBCMT ref: 0041EDBD
_free.LIBCMT ref: 0041EDC8
_free.LIBCMT ref: 0041EDD3
_free.LIBCMT ref: 0041EDDE
_free.LIBCMT ref: 0041EDE9
_free.LIBCMT ref: 0041EDF7

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b518f20b764996853f57fbd2a3fdc4e7bf3deb810a08f9cd0b2a52dd965201da
Instruction ID: e610bd300bd5c2f85586062e27af9f16ff799e012d6f089a2169b26ee7872c24
Opcode Fuzzy Hash: b518f20b764996853f57fbd2a3fdc4e7bf3deb810a08f9cd0b2a52dd965201da
Instruction Fuzzy Hash: ED219CBA910108BFCB41EF96C941DDD7BF6BF88344F00416AF9199B121EB35DA84DB84

Uniqueness

Uniqueness Score: -1.00%

Function 00404180 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 166networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(00434EF4,00000000,00000000,00000000,00000000), ref: 0040425C
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040426E
InternetReadFile.WININET(00000000,?,03E80000,03E80000), ref: 00404281
InternetCloseHandle.WININET(00000000), ref: 00404292
InternetCloseHandle.WININET(00000000), ref: 00404295
InternetCloseHandle.WININET(00000000), ref: 004042A3
InternetCloseHandle.WININET(00000000), ref: 004042A6

Strings

runas, xrefs: 004043B4

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: Internet$CloseHandle$Open$FileRead
String ID: runas
API String ID: 4294395943-4000483414
Opcode ID: ede4e6356156c8ab4243dfa032a0409c686b6a0ba36998d547ea5ec34ec217d5
Instruction ID: ba1dc25ec83469701d4c7edc2e7ba4793e46b241d410edfdecdbeb0a0fce58bd
Opcode Fuzzy Hash: ede4e6356156c8ab4243dfa032a0409c686b6a0ba36998d547ea5ec34ec217d5
Instruction Fuzzy Hash: 4951D571E00108ABDB14DFA4DC41BEEBB75EF85300F60816EF915B7291D7389945CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00426582 Relevance: 13.8, APIs: 9, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5ce67aa41b5f7f4889b1a1a20be5028291e55dfd00ef2a2d6d7ad31bcea8bed
Instruction ID: 5128a0cef717139e7719faf6ed0b9fe75c650819d7ce78bb109199c1610a9dbc
Opcode Fuzzy Hash: f5ce67aa41b5f7f4889b1a1a20be5028291e55dfd00ef2a2d6d7ad31bcea8bed
Instruction Fuzzy Hash: D3C114B4B002159FDF11DF99E880BAEBBB0BF49304F51406AE914A7382C7789D81CF69

Uniqueness

Uniqueness Score: -1.00%

Function 004235FD Relevance: 13.8, APIs: 9, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004232B6: CreateFileW.KERNEL32(00000000,00000000,?,004236A6,?,?,00000000,?,004236A6,00000000,0000000C), ref: 004232D3

GetLastError.KERNEL32 ref: 00423711
__dosmaperr.LIBCMT ref: 00423718
GetFileType.KERNEL32(00000000), ref: 00423724
GetLastError.KERNEL32 ref: 0042372E
__dosmaperr.LIBCMT ref: 00423737
CloseHandle.KERNEL32(00000000), ref: 00423757
CloseHandle.KERNEL32(?), ref: 004238A4
GetLastError.KERNEL32 ref: 004238D6
__dosmaperr.LIBCMT ref: 004238DD

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 0d649afaf30192c5c19431845a951fd0479d0f23fa76b0b367cd72335b8b290c
Instruction ID: c7b97c56f1a0d1b911df166da15c54d720095dd6c25035754b532be6d98a6b0c
Opcode Fuzzy Hash: 0d649afaf30192c5c19431845a951fd0479d0f23fa76b0b367cd72335b8b290c
Instruction Fuzzy Hash: 7CA15872A041149FCF19DF68EC917AE3BB1AB06325F54016EF811AB391CB7C8952CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00421A27 Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00421A51
_free.LIBCMT ref: 00421B2A
_free.LIBCMT ref: 00421B57

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 260dabd453d74701cb9a01dd90e077a135ccfcbca354cdd74d2d71df0f34a932
Instruction ID: f188bb2de727b7b751c2d84351da10a70f250225146cef8743706f99745805fe
Opcode Fuzzy Hash: 260dabd453d74701cb9a01dd90e077a135ccfcbca354cdd74d2d71df0f34a932
Instruction Fuzzy Hash: 0E518C74F44324AFDB24AFB7A881A6E7BB4AF11314F54416FE410972A1EA3D8940CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 004194D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00419507
___except_validate_context_record.LIBVCRUNTIME ref: 0041950F
_ValidateLocalCookies.LIBCMT ref: 00419598
__IsNonwritableInCurrentImage.LIBCMT ref: 004195C3
_ValidateLocalCookies.LIBCMT ref: 00419618

Strings

csm, xrefs: 004195AD

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 170db4f13a52bbc04fbb15fe7ab42c90d24a7c19ae8ceb0e3c19913b98646896
Instruction ID: cf6a3be1c1e6f4323defd25786acadca5afaa418f9c93884064ec3a043526e94
Opcode Fuzzy Hash: 170db4f13a52bbc04fbb15fe7ab42c90d24a7c19ae8ceb0e3c19913b98646896
Instruction Fuzzy Hash: 09411A31A00214AFCF11DF69C890ADEBBB1BF45318F54806BE8146B352D739DE96CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041F14C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 0041F1A3
ext-ms-, xrefs: 0041F1B7

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: d346eea9aafd959945e16ecfc9ebbe047e966c499b5e8e0d3b3e0bbc48b51e8c
Instruction ID: 8946f5363388c355846af12649c4142b4e9cf4c5f65ba016e67a922269825e5f
Opcode Fuzzy Hash: d346eea9aafd959945e16ecfc9ebbe047e966c499b5e8e0d3b3e0bbc48b51e8c
Instruction Fuzzy Hash: 3521C672A41221FBCB318A24DC45A9B3778AB017A0F650532ED15A7391D638ED4BC5DC

Uniqueness

Uniqueness Score: -1.00%

Function 0042238B Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00422353: _free.LIBCMT ref: 00422378

_free.LIBCMT ref: 004223D9

Part of subcall function 0041E5A1: HeapFree.KERNEL32(00000000,00000000,?,0042237D,?,00000000,?,?,?,004223A4,?,00000007,?,?,004227A6,?), ref: 0041E5B7
Part of subcall function 0041E5A1: GetLastError.KERNEL32(?,?,0042237D,?,00000000,?,?,?,004223A4,?,00000007,?,?,004227A6,?,?), ref: 0041E5C9

_free.LIBCMT ref: 004223E4
_free.LIBCMT ref: 004223EF
_free.LIBCMT ref: 00422443
_free.LIBCMT ref: 0042244E
_free.LIBCMT ref: 00422459
_free.LIBCMT ref: 00422464

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 745ba4c7df38b0c8b3501d58b22aa89868de86b005191e755d783c3d27d16807
Instruction ID: 3666b1e76cecdb1a9706d82e7bd79ae187b091a1e89744abee2c0a3d449e73e2
Opcode Fuzzy Hash: 745ba4c7df38b0c8b3501d58b22aa89868de86b005191e755d783c3d27d16807
Instruction Fuzzy Hash: C611E471601714BAD921F7B2DD47FCB77DD5F0834CF84881EBACD6A052D6ACB6514604

Uniqueness

Uniqueness Score: -1.00%

Function 00423A46 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00405880,00000000), ref: 00423A8E
__fassign.LIBCMT ref: 00423C6D
__fassign.LIBCMT ref: 00423C8A
WriteFile.KERNEL32(?,00405880,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00423CD2
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00423D12
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00423DBE

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 5a0c35df1f21bdc5310913443ad541efee69954072d07ce9ea6e444a121a2afd
Instruction ID: 55294dd1ed643e62d688e25fe7fc8b93d32e6dca02253c809cdcf0ede3e7f937
Opcode Fuzzy Hash: 5a0c35df1f21bdc5310913443ad541efee69954072d07ce9ea6e444a121a2afd
Instruction Fuzzy Hash: 21D1A075E002689FCF15CFA8D8809EDBBB5BF48314F64016AE455FB342D738AA46CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004197F0 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,004197E7,004193D7,00418C1C), ref: 004197FE
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0041980C
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00419825
SetLastError.KERNEL32(00000000,004197E7,004193D7,00418C1C), ref: 00419877

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 0f6e51aa0c255468b6a622d8c735b9b5b069fdda8c7ed9770d7dbe64c9198e0d
Instruction ID: 71a7697fc03e6214697c45e1a132a8316019e6706060db725442c6d2a3e753c8
Opcode Fuzzy Hash: 0f6e51aa0c255468b6a622d8c735b9b5b069fdda8c7ed9770d7dbe64c9198e0d
Instruction Fuzzy Hash: F101D8326293115EE62C3B76AE959D72774EF067B8720023FF120441F1EF594C95D58D

Uniqueness

Uniqueness Score: -1.00%

Function 00420F7C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe, xrefs: 00420F81

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe
API String ID: 0-3338832412
Opcode ID: d9fd3d3f386e086f16d5e96c86dfc6c05a3e177acafcacdda8c025444d2164cb
Instruction ID: f2c65a4c72dcbe00dc32dc221c8eb50b3435d1ebdf66b1fbb5bbc6e11338d05a
Opcode Fuzzy Hash: d9fd3d3f386e086f16d5e96c86dfc6c05a3e177acafcacdda8c025444d2164cb
Instruction Fuzzy Hash: CB210A713001257F97206F71ED81D6BB7ADAF103A8750462BF828D7691D778DC818799

Uniqueness

Uniqueness Score: -1.00%

Function 0041C3D6 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 0041C418

Strings

.bat, xrefs: 0041C447
.exe, xrefs: 0041C425
.cmd, xrefs: 0041C436
.com, xrefs: 0041C458

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 19671788b65354572937ca0f5259cacd468799deb2890a42aa5f1fe1ebfecd1d
Instruction ID: baa428b651ab7fadd2aefce0a8d8cefe58070258f098f4f191bca89b56dcb2ea
Opcode Fuzzy Hash: 19671788b65354572937ca0f5259cacd468799deb2890a42aa5f1fe1ebfecd1d
Instruction Fuzzy Hash: 7E012B3BA8C635212624101AEC62BF717988B96FB8B25412FF854F72C1ED9DEC8205DC

Uniqueness

Uniqueness Score: -1.00%

Function 0041A897 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 0041A8E7

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: d7b12ed5c3c764c8b82cc7f1cf76b5788b814adb9963f19d14a8505e8bb0b4a8
Instruction ID: 8addbc20e8b4f1572ca5f78bff053ba989236767de5a1c4d832f47c373f0c560
Opcode Fuzzy Hash: d7b12ed5c3c764c8b82cc7f1cf76b5788b814adb9963f19d14a8505e8bb0b4a8
Instruction Fuzzy Hash: 2B112C71A12221EBC7314B249D44AAB37689F017B4B624933ED45AB390D738DDE1C5DE

Uniqueness

Uniqueness Score: -1.00%

Function 0041B943 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,0041B938,?,?,0041B900,0041BE86,?,NA), ref: 0041B958
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0041B96B
FreeLibrary.KERNEL32(00000000,?,?,0041B938,?,?,0041B900,0041BE86,?,NA), ref: 0041B98E

Strings

CorExitProcess, xrefs: 0041B963
mscoree.dll, xrefs: 0041B951

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: af14fd2dde53d7be7e540de01eeb28501674720f1683c90e0ca13ac16e635f3d
Instruction ID: 6ab08718997dcf592451d77b1cbf540418157bbc441c253cf8170436862d5d78
Opcode Fuzzy Hash: af14fd2dde53d7be7e540de01eeb28501674720f1683c90e0ca13ac16e635f3d
Instruction Fuzzy Hash: 52F08230651218FBDB259B50DD0ABEEBA78DF44759F900175A504A1260CB788E46DA98

Uniqueness

Uniqueness Score: -1.00%

Function 00424BC4 Relevance: 7.9, APIs: 5, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00424C46
_free.LIBCMT ref: 00424C6A
_free.LIBCMT ref: 00424DF7
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,004335D8), ref: 00424E09
_free.LIBCMT ref: 00424FC3

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: 0fe61e17206dce54771a5055940e70056e7a200eab18ece9396fc025dad7d191
Instruction ID: 2c4f844ee906d1c5b8a05b7d4d89c1c9074c071bb98950a21f89e01ce9d05ddf
Opcode Fuzzy Hash: 0fe61e17206dce54771a5055940e70056e7a200eab18ece9396fc025dad7d191
Instruction Fuzzy Hash: 1FC17835B00128ABDB209F69EC41BAB7BA9EFC5354F94416FE550D7381E7388E01CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00426FA9 Relevance: 7.7, APIs: 5, Instructions: 244COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00874140,00874140,?,7FFFFFFF,?,?,00427265,00874140,00874140,?,00874140,?,?,?,?,00874140), ref: 0042704C
__alloca_probe_16.LIBCMT ref: 00427102
__alloca_probe_16.LIBCMT ref: 00427198
__freea.LIBCMT ref: 00427203
__freea.LIBCMT ref: 0042720F

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: c559a93f2d06cee59e46b38ea2fc726286989e451536d90b3fb509578e86aae3
Instruction ID: f6d9b8f12c634194a1b411eace1e19527ea88e01b30f60a4b5a6e0b516c13e2d
Opcode Fuzzy Hash: c559a93f2d06cee59e46b38ea2fc726286989e451536d90b3fb509578e86aae3
Instruction Fuzzy Hash: 4481E472B082259BDF219EA5AC41EEF7BB5EF09354F98005BF804A7341D62DCC458BB9

Uniqueness

Uniqueness Score: -1.00%

Function 004258D4 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00425958
__alloca_probe_16.LIBCMT ref: 00425A1E
__freea.LIBCMT ref: 00425A8A

Part of subcall function 0041EA8A: RtlAllocateHeap.NTDLL(00000000,?,?,?,004191D3,?,?,?,?,?,004020F3,?,?), ref: 0041EABC

__freea.LIBCMT ref: 00425A93
__freea.LIBCMT ref: 00425AB6

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 801bfc73f5307c034d341afffc150cc0786828de70bde5b9b10ebb0cec96e4eb
Instruction ID: 7e0d7c363e2f027523b7077ca53f82abc72318da18e9cc0c3b19bc4bba63112a
Opcode Fuzzy Hash: 801bfc73f5307c034d341afffc150cc0786828de70bde5b9b10ebb0cec96e4eb
Instruction Fuzzy Hash: 8351E672700626AFDB209F95EC86EBF37A9EF44764F95422AFC04D7240E778DC418698

Uniqueness

Uniqueness Score: -1.00%

Function 0041C10E Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,0041C040), ref: 0041C130
GetFileInformationByHandle.KERNEL32(?,?), ref: 0041C18A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0041C040,?,000000FF,00000000,00000000), ref: 0041C218
__dosmaperr.LIBCMT ref: 0041C21F
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 0041C25C

Part of subcall function 0041C484: __dosmaperr.LIBCMT ref: 0041C4B9

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: 8e7ecedbbb3726c11739f19b321c018a01a8de47d4bdd8436282d5c79af9c44f
Instruction ID: 0071a9752275d4edb8b9c21b1954eb469a97b67ce05b4548820d0adabff3a4d5
Opcode Fuzzy Hash: 8e7ecedbbb3726c11739f19b321c018a01a8de47d4bdd8436282d5c79af9c44f
Instruction Fuzzy Hash: B7413C75940204AFDB249FA5DC859EFBBF9EF89700B00452EF856D3610E7389885CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004222EA Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00422302

Part of subcall function 0041E5A1: HeapFree.KERNEL32(00000000,00000000,?,0042237D,?,00000000,?,?,?,004223A4,?,00000007,?,?,004227A6,?), ref: 0041E5B7
Part of subcall function 0041E5A1: GetLastError.KERNEL32(?,?,0042237D,?,00000000,?,?,?,004223A4,?,00000007,?,?,004227A6,?,?), ref: 0041E5C9

_free.LIBCMT ref: 00422314
_free.LIBCMT ref: 00422326
_free.LIBCMT ref: 00422338
_free.LIBCMT ref: 0042234A

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a090e3dca2e19da394a01cead958df991e42452585b2f6658ee12e14c4d52992
Instruction ID: 8eed935d1f0a41e2b9dbe60b1656bd2ba3e28f3ae1fefd92f9cbf16fd4f54630
Opcode Fuzzy Hash: a090e3dca2e19da394a01cead958df991e42452585b2f6658ee12e14c4d52992
Instruction Fuzzy Hash: 04F04472501210B78520DBA6F6C2C4B73DAAB94355794180AF809D7641C77CFD81866C

Uniqueness

Uniqueness Score: -1.00%

Function 004209B7 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00420B51

Strings

*?, xrefs: 004209FA

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 4349432449d004c56f1fbb459abf86acb5202655a551f523de74eb3488688e5f
Instruction ID: 7415b14c5d0124b7c9719d17695bca9e12f23279d28e73ebbb8fdbf8e8460f59
Opcode Fuzzy Hash: 4349432449d004c56f1fbb459abf86acb5202655a551f523de74eb3488688e5f
Instruction Fuzzy Hash: 5661A1B5E002299FCB14CFA9D8815EEFBF5EF48314B54816AE805F7301E735AE418B94

Uniqueness

Uniqueness Score: -1.00%

Function 004198D0 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00419997
___AdjustPointer.LIBCMT ref: 004199BA
___AdjustPointer.LIBCMT ref: 00419A56

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 7e8d2a906245dc524fe8c50e746b229fe3151c293ccc1eab8f3b2c5d31764d92
Instruction ID: a8cd01a110c9a5ba9b93cdf8b6ca506de852c713b8af7688bfec1274bd28d331
Opcode Fuzzy Hash: 7e8d2a906245dc524fe8c50e746b229fe3151c293ccc1eab8f3b2c5d31764d92
Instruction Fuzzy Hash: 3251D0B2601286AFDB298F15D861BEA77A4EF04314F24012FE84646391E739ECC1C799

Uniqueness

Uniqueness Score: -1.00%

Function 00405400 Relevance: 6.2, APIs: 4, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,34AAABE9,00000000), ref: 00405479
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004054E0
GetProcAddress.KERNEL32(00000000), ref: 004054E7

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: AddressHandleModuleProcVersion
String ID:
API String ID: 3310240892-0
Opcode ID: 3a7e95708154f6916853b84b21f3cd0acf8b247c8ce27c36d8ff6b2a54ddc4e8
Instruction ID: 1307c1e28f23caf99c3cad6e9d6b2b61846357279e254348caa37701d54b456e
Opcode Fuzzy Hash: 3a7e95708154f6916853b84b21f3cd0acf8b247c8ce27c36d8ff6b2a54ddc4e8
Instruction Fuzzy Hash: B8513971900608ABDB14DB24DD497DE7B76EB46314F5042BAE805B73C1DB389EC48F99

Uniqueness

Uniqueness Score: -1.00%

Function 00425F0E Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00425FDE
_free.LIBCMT ref: 00426007
SetEndOfFile.KERNEL32(00000000,0042354B,00000000,?,?,?,?,?,?,?,?,0042354B,?,00000000), ref: 00426039
GetLastError.KERNEL32(?,?,?,?,?,?,?,0042354B,?,00000000,?,?,?,?,?), ref: 00426055

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 1b46a168150b59dd7f484fb80afce3f9d1467af84aa4dd7d5580741876eb59e2
Instruction ID: 61c1fed18fa2e053e229d2c366b1320fca6b3d495f3fb51fd3c042a4ee27fee9
Opcode Fuzzy Hash: 1b46a168150b59dd7f484fb80afce3f9d1467af84aa4dd7d5580741876eb59e2
Instruction Fuzzy Hash: 6C413E72B006115BDB11ABB5ED41B8E37B6AF44364F560017F424E72D2EB7CC840576D

Uniqueness

Uniqueness Score: -1.00%

Function 004208E8 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0041BD6F: _free.LIBCMT ref: 0041BD7D

Part of subcall function 004218BF: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,00425A80,?,00000000,00000000), ref: 00421961

GetLastError.KERNEL32 ref: 00420950
__dosmaperr.LIBCMT ref: 00420957
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 00420996
__dosmaperr.LIBCMT ref: 0042099D

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 2cc476a48764411ac7d7f7841f806bb526956e32d48153aac2d156f6a7af72d6
Instruction ID: 91911ec1de34df9e01eb008ea9a24e12f878ac442d2ad626700c96a69c790fc9
Opcode Fuzzy Hash: 2cc476a48764411ac7d7f7841f806bb526956e32d48153aac2d156f6a7af72d6
Instruction Fuzzy Hash: 2721F0B1700225AFA710AF62ACC196B77EDEF00374790851AF86697253D738DCC08B94

Uniqueness

Uniqueness Score: -1.00%

Function 0041EE92 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,0041BCED,00000000,?,?,?,0041BE86,?), ref: 0041EE97
_free.LIBCMT ref: 0041EEF4
_free.LIBCMT ref: 0041EF2A
SetLastError.KERNEL32(00000000,00000008,000000FF,?,?,?,0041BE86,?), ref: 0041EF35

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 75c439bd07e5c140abce3c4c364696c07bf38f8c954372fab3069a11bd660fc8
Instruction ID: 26790fddcd24ef136aadc0cc0bf27d5f777129a8301660e6568487d79e7ca8b5
Opcode Fuzzy Hash: 75c439bd07e5c140abce3c4c364696c07bf38f8c954372fab3069a11bd660fc8
Instruction Fuzzy Hash: 2411CA3A6002017AD61427B79CC59EB256997C1779B25013BFD39832D2FE6D8CDB811D

Uniqueness

Uniqueness Score: -1.00%

Function 0041EFE9 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0041C755,0041EACD,?,?,004191D3,?,?,?,?,?,004020F3,?,?), ref: 0041EFEE
_free.LIBCMT ref: 0041F04B
_free.LIBCMT ref: 0041F081
SetLastError.KERNEL32(00000000,00000008,000000FF,?,?,004191D3,?,?,?,?,?,004020F3,?,?), ref: 0041F08C

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: ff05b0e8af83039ccd4e2bcecb2eca9c121a5a1b09bf2688f1c3f19d4c897a95
Instruction ID: d1a755533480a66cbcbdd6da6f61a8fcfdc6096e1f08231a3cc2ec091d2cf52b
Opcode Fuzzy Hash: ff05b0e8af83039ccd4e2bcecb2eca9c121a5a1b09bf2688f1c3f19d4c897a95
Instruction Fuzzy Hash: FB114C322045016AC7102B76ACC1DEB2969DBC8778765023BF92A822E3EF6CCCDF511C

Uniqueness

Uniqueness Score: -1.00%

Function 0041F7CB Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,0041F930,00000000,?,00424658,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 0041F7E1
GetLastError.KERNEL32(?,00424658,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,0041F930,00000000,00000104,?), ref: 0041F7EB
__dosmaperr.LIBCMT ref: 0041F7F2

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 05d28394caa5e79c84551c055246600de674f2baba94b68408dd47ae0dfcca9d
Instruction ID: 3e1febbc0a8defaca1089d50814ae8bcfad4f789bcb8220d5dd2739c2ed7ebaf
Opcode Fuzzy Hash: 05d28394caa5e79c84551c055246600de674f2baba94b68408dd47ae0dfcca9d
Instruction Fuzzy Hash: 1DF06D36600115BB8B202FA2DD08C9BBFA9FF443A03444136F52DC7561DB35E8A6CBE8

Uniqueness

Uniqueness Score: -1.00%

Function 0041F834 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,0041F930,00000000,?,004245E3,00000000,00000000,0041F930,?,?,00000000,00000000,00000001), ref: 0041F84A
GetLastError.KERNEL32(?,004245E3,00000000,00000000,0041F930,?,?,00000000,00000000,00000001,00000000,00000000,?,0041F930,00000000,00000104), ref: 0041F854
__dosmaperr.LIBCMT ref: 0041F85B

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: e95b58acd20ff03b7de0604d3f95648f78153c488b68a8cfe7999cd59df17e1a
Instruction ID: 5356ccb821a571137923583999cca56af5607f561d8780d9d137012589ba4a16
Opcode Fuzzy Hash: e95b58acd20ff03b7de0604d3f95648f78153c488b68a8cfe7999cd59df17e1a
Instruction Fuzzy Hash: FBF01231600115BB8B207BA6DC0499BBFA9FF443A03404536F52DC6521C735E8A6DBD4

Uniqueness

Uniqueness Score: -1.00%

Function 004272CF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00405880,00000000,00437A28,00000000,00405880,?,004269E7,00405880,00000001,00405880,00405880,?,00423E1B,00000000,?,00405880), ref: 004272E6
GetLastError.KERNEL32(?,004269E7,00405880,00000001,00405880,00405880,?,00423E1B,00000000,?,00405880,00000000,00405880,?,0042436F,00405880), ref: 004272F2

Part of subcall function 004272B8: CloseHandle.KERNEL32(FFFFFFFE,00427302,?,004269E7,00405880,00000001,00405880,00405880,?,00423E1B,00000000,?,00405880,00000000,00405880), ref: 004272C8

___initconout.LIBCMT ref: 00427302

Part of subcall function 0042727A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,004272A9,004269D4,00405880,?,00423E1B,00000000,?,00405880,00000000), ref: 0042728D

WriteConsoleW.KERNEL32(00405880,00000000,00437A28,00000000,?,004269E7,00405880,00000001,00405880,00405880,?,00423E1B,00000000,?,00405880,00000000), ref: 00427317

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 654839e4b531a485c8561e35f9c6b1b80fe1c4fa203d6a6e5454fb2027dc39d5
Instruction ID: 5b8baa1da4bb66d128bbbdf819d740daca6d0282673a7c9b135cb97f91750bdc
Opcode Fuzzy Hash: 654839e4b531a485c8561e35f9c6b1b80fe1c4fa203d6a6e5454fb2027dc39d5
Instruction Fuzzy Hash: 46F01C36201129FBCF221F95EC04A8A3F66FF093A1B814075FE1C86231D6328820EB98

Uniqueness

Uniqueness Score: -1.00%

Function 004167E0 Relevance: 6.0, APIs: 4, Instructions: 27threadsleepCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 004167F6
CreateThread.KERNEL32 ref: 00416807
CreateThread.KERNEL32 ref: 00416818
Sleep.KERNEL32(00007530,?,00416873), ref: 00416825

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: CreateThread$Sleep
String ID:
API String ID: 422425972-0
Opcode ID: c7ec29c90368d79a70c95a5ee9845132da8938ab2cedaa7c12f416f09ab0d9a8
Instruction ID: 3e58bb4c01d1f945cb402fb00719d76fe511b7683de936d62f19d1048555ce50
Opcode Fuzzy Hash: c7ec29c90368d79a70c95a5ee9845132da8938ab2cedaa7c12f416f09ab0d9a8
Instruction Fuzzy Hash: 69E09231BE8334B6F47126A45C03F891E545B08F95FB20023B70CBE4D084C87485CAEE

Uniqueness

Uniqueness Score: -1.00%

Function 0041D819 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041D822

Part of subcall function 0041E5A1: HeapFree.KERNEL32(00000000,00000000,?,0042237D,?,00000000,?,?,?,004223A4,?,00000007,?,?,004227A6,?), ref: 0041E5B7
Part of subcall function 0041E5A1: GetLastError.KERNEL32(?,?,0042237D,?,00000000,?,?,?,004223A4,?,00000007,?,?,004227A6,?,?), ref: 0041E5C9

_free.LIBCMT ref: 0041D835
_free.LIBCMT ref: 0041D846
_free.LIBCMT ref: 0041D857

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5b4b832eec97106c71e74c3abf3533cea5e390173416251ec6b9798646083543
Instruction ID: 2f128d3171f244c94fc48b8332bc88089a284fec835ab8af747093701a289460
Opcode Fuzzy Hash: 5b4b832eec97106c71e74c3abf3533cea5e390173416251ec6b9798646083543
Instruction Fuzzy Hash: C3E04FB4801520AFCE012F53FE055953BA2FB947EC340302AF81406232DB390261EFCE

Uniqueness

Uniqueness Score: -1.00%

Function 004122F0 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 374COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00412FEF

Part of subcall function 00416F50: Concurrency::cancel_current_task.LIBCPMT ref: 00417083

Strings

invalid stoi argument, xrefs: 00412FEA
stoi argument out of range, xrefs: 00412FF9

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: Concurrency::cancel_current_taskXinvalid_argumentstd::_
String ID: invalid stoi argument$stoi argument out of range
API String ID: 3646673767-1606216832
Opcode ID: b8df3df11c9997a28d75ab609b373ec4d34966bb998b75cd7ce6713ad255ec23
Instruction ID: 6d18bec53ddcbea06decae191a6eae5fb5e1180c669e5708db714ed38e612d95
Opcode Fuzzy Hash: b8df3df11c9997a28d75ab609b373ec4d34966bb998b75cd7ce6713ad255ec23
Instruction Fuzzy Hash: 60E1D171A001189BEF28DF28CE857DDBB72EB46304F50819EE419972C1DB799AD1CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0041CE88 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe, xrefs: 0041CECB, 0041CED2, 0041CF08

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe
API String ID: 0-3338832412
Opcode ID: 31fa4e4f4f0bc981144b5b3ffc5fea1ddf45f4662b4ea0433f5b95f05539bbed
Instruction ID: 3e019bb9f1f37e8f56b3af26f626c64f14fa1fa210d5d8f79d997b38734a4c96
Opcode Fuzzy Hash: 31fa4e4f4f0bc981144b5b3ffc5fea1ddf45f4662b4ea0433f5b95f05539bbed
Instruction Fuzzy Hash: 9A41A271A80214AFDB11DF9A9CC19EFBBB9EB85710F10006BF40497251D7788E82CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00419EDD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00419F02

Strings

RCC, xrefs: 00419F1C
MOC, xrefs: 00419F14

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 56cf5a80f9e67a63b3ea8228320d3624bd09d448c8f94bbe6aa890cfa768ed17
Instruction ID: ef4240616421f5d170a5d1c4fd7b0d446090a164c11462a96303fe54a6744129
Opcode Fuzzy Hash: 56cf5a80f9e67a63b3ea8228320d3624bd09d448c8f94bbe6aa890cfa768ed17
Instruction Fuzzy Hash: 5C414872900209EFCF16DF98C981AEEBBB5FF48304F18819AF904A7251D3399DA1DB55

Uniqueness

Uniqueness Score: -1.00%

Function 00412CFF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00412D18

Strings

., xrefs: 00412DCB
5120, xrefs: 00412D5F

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: FileModuleName
String ID: .$5120
API String ID: 514040917-2446372808
Opcode ID: f99830547a012116d5b52b04e72eafd6a293cbb33d9ac81bb1d8b6fc8795619a
Instruction ID: 9696d8c15566c1d42fadb68592e21f39738dfdc301de5d2260ec8dd83da14f2d
Opcode Fuzzy Hash: f99830547a012116d5b52b04e72eafd6a293cbb33d9ac81bb1d8b6fc8795619a
Instruction Fuzzy Hash: D421E2B09002489BDB14EF69C90A7DD7FB49F06348F5001CEE44567282D7B99A498BE7

Uniqueness

Uniqueness Score: -1.00%

Function 00423927 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041FDF2: EnterCriticalSection.KERNEL32(00405880,?,00424223,00405880,00437D48,00000010,0041EA11,00000000,C032C301,00000000,00000000,00405880,?,0041BB1A,00405880,00000000), ref: 0041FE0D

FlushFileBuffers.KERNEL32(00000000,00437D28,0000000C,00423A2E,nA,?,00000001,?,0041E96E,?), ref: 00423970
GetLastError.KERNEL32 ref: 00423981

Strings

nA, xrefs: 004239A8

Memory Dump Source

Source File: 00000005.00000002.346421950.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.346893463.000000000043E000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rovwer.jbxd

Similarity

API ID: BuffersCriticalEnterErrorFileFlushLastSection
String ID: nA
API String ID: 4109680722-4035868545
Opcode ID: f003fc8eaf19488ae7f9339aa40c70496bc05c9f4a2d22a8ae3e610d030b7c35
Instruction ID: 0418fce989e2f534913a4f38d2ce8aa3e5464a19317c2ea272403c313fbf0c0e
Opcode Fuzzy Hash: f003fc8eaf19488ae7f9339aa40c70496bc05c9f4a2d22a8ae3e610d030b7c35
Instruction Fuzzy Hash: 45018076B002108FC714AF69E90569D7BB5AF49724F50412FF4219B3D2DBBC9982CB98

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Application logs, Process monitoring, Windows Error Reporting
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	File monitoring, Process command-line parameters
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7cduUYXDtl.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred64[1].dll

C:\Users\user\AppData\Local\Temp\853321935212

C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe

C:\Users\user\AppData\Local\Temp\e94c2b28f2\rovwer.exe:Zone.Identifier

C:\Users\user\AppData\Roaming\80b59841e5c623\cred64.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
7cduUYXDtl.exe

Function 0041B901 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Function 021B092B Relevance: 3.8, Strings: 3, Instructions: 90
COMMON

Function 00404350 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 121
COMMON

Function 004235FD Relevance: 13.8, APIs: 9, Instructions: 273
COMMONLIBRARYCODE

Function 021B003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Function 0041D1BB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33
COMMON

Function 004219A3 Relevance: 4.6, APIs: 3, Instructions: 68
COMMON

Function 0042356F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42
COMMONLIBRARYCODE

Function 021B0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Function 0041E3FF Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Function 00416830 Relevance: 1.5, APIs: 1, Instructions: 36
networkCOMMON

Function 0041EA8A Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Function 004232B6 Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMONLIBRARYCODE

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	API monitoring, File monitoring, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre